Bump prismjs to ^1.26.0 [SECURITY] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
prismjs	1.26.0 -> 1.27.0

GitHub Vulnerability Alerts

CVE-2022-23647

Impact

Prism's Command line plugin can be used by attackers to achieve an XSS attack. The Command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code.

Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted.

Patches

This bug has been fixed in v1.27.0.

Workarounds

Do not use the Command line plugin on untrusted inputs, or sanitized all code blocks (remove all HTML code text) from all code blocks that use the Command line plugin.

References

• Command Line: Escape markup in command line output PrismJS/prism#3341

---

Release Notes

PrismJS/prism

v1.27.0

Compare Source

New components

• UO Razor Script (#​3309) 3f8cc5a0

Updated components

• AutoIt
  • Allow hyphen in directive (#​3308) bcb2e2c8
• EditorConfig
  • Change alias of section from keyword to selector (#​3305) e46501b9
• Ini
  • Swap out header for section (#​3304) deb3a97f
• MongoDB
  • Added v5 support (#​3297) 8458c41f
• PureBasic
  • Added missing keyword and fixed constants ending with $ (#​3320) d6c53726
• Scala
  • Added support for interpolated strings (#​3293) 441a1422
• Systemd configuration file
  • Swap out operator for punctuation (#​3306) 2eb89e15

Updated plugins

• Command Line
  • Escape markup in command line output (#​3341) e002e78c
  • Add support for line continuation and improved colors (#​3326) 1784b175
  • Added span around command and output (#​3312) 82d0ca15

Other

• Core
  • Added better error message for missing grammars (#​3311) 2cc4660b

---

Configuration

📅 Schedule: "" in timezone UTC.

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by WhiteSource Renovate. View repository job log here.