CVE-2020-15138: 
JavaScript vulnerability analysis and mitigation

Prism's Previewers plugin contained a Cross-Site Scripting (XSS) vulnerability (CVE-2020-15138) that affected versions >=1.1.0 and <1.21.0. The vulnerability specifically impacted the easing preview feature, allowing attackers to execute arbitrary code in Safari and Internet Explorer browsers. This security issue affected all Safari and Internet Explorer users of Prism that utilized either the Previewers plugin (>=v1.10.0) or the Previewer: Easing plugin (v1.1.0 to v1.9.0) (GitHub Advisory).

The vulnerability was discovered in the easing preview functionality of the Previewers plugin. It was introduced through a commit on September 29, 2015, and was eventually fixed by security researcher Masato Kinugawa. The issue received a CVSS v3.1 base score of 7.5 (HIGH) from NIST with a vector string of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L, indicating a network-exploitable vulnerability requiring user interaction (NVD).

The vulnerability allowed attackers to execute arbitrary code through cross-site scripting attacks specifically in Safari and Internet Explorer browsers. This could potentially lead to unauthorized access to user data and compromise of browser security in the context of sites using affected versions of the Prism library (GitHub Advisory).

The vulnerability required user interaction and was specifically exploitable in Safari and Internet Explorer browsers. The attack complexity was rated as high, but no authentication was required to exploit the vulnerability. No public exploits were documented at the time of disclosure (NVD).

The vulnerability was patched in Prism version 1.21.0. For users unable to upgrade immediately, a workaround was provided that involved disabling the easing preview on all impacted code blocks, though this workaround required Prism v1.10.0 or newer to implement (GitHub Advisory, Prism Docs).