CVE-2020-15138

Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the _Previewers_ plugin (>=v1.10.0) or the _Previewer: Easing_ plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.

• CWE-79
• CWE-79

• https://github.com/PrismJS/prism/pull/2506/commits/7bd7de05edf71112a3a77f87901a2409c9c5c20cPatch, Third Party Advisory
• https://github.com/PrismJS/prism/security/advisories/GHSA-wvhm-4hhf-97x9Third Party Advisory
• https://prismjs.com/plugins/previewers/#disabling-a-previewerVendor Advisory
• https://github.com/PrismJS/prism/pull/2506/commits/7bd7de05edf71112a3a77f87901a2409c9c5c20cPatch, Third Party Advisory
• https://github.com/PrismJS/prism/security/advisories/GHSA-wvhm-4hhf-97x9Third Party Advisory
• https://prismjs.com/plugins/previewers/#disabling-a-previewerVendor Advisory

Published

Aug 7, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15132In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the …5.3
• CVE-2020-15133In faye-websocket before version 0.11.0, there is a lack of …8.7
• CVE-2020-15134Faye before version 1.4.0, there is a lack of certification …8.7
• CVE-2020-15135save-server (npm package) before version 1.05 is affected by…7.6
• CVE-2020-15136In ectd before versions 3.4.10 and 3.3.23, gateway TLS authe…6.5
• CVE-2020-15137All versions of HoRNDIS are affected by an integer overflow …5.9
• CVE-2020-15139In MyBB before version 1.8.24, the custom MyCode (BBCode) fo…6.1
• CVE-2020-1514<p>A cross-site-scripting (XSS) vulnerability exists when Mi…5.4
• CVE-2020-15140In Red Discord Bot before version 3.3.11, a RCE exploit has …9.6
• CVE-2020-15141In openapi-python-client before version 0.5.3, there is a pa…4.1
• CVE-2020-15142In openapi-python-client before version 0.5.3, clients gener…9
• CVE-2020-15143In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2…8.8