-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| prismjs | npm | < 1.30.0 | 1.30.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how Prism checked document.currentScript. The original code (CVE-2024-53382) only verified 'currentScript' property existence in document. Attackers could inject HTML elements (e.g., <img name='currentScript'>) to override this property. The patched commit adds explicit tagName validation (document.currentScript.tagName === 'SCRIPT'), confirming the vulnerable code path was in the currentScript utility function. This function is central to script path detection in Prism's autoloader plugin, making it the attack surface for DOM clobbering.
A Semantic Attack on Google Gemini - Read the Latest Research