GHSA-gj77-59wh-66hgHighCVSS 7.4

Regular Expression Denial of Service (ReDoS) in Prism

Published
June 28, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-32723 →

📋 Description

Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS).

Impact

When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. Do not use the following languages to highlight untrusted text.

  • ASCIIDoc
  • ERB

Other languages are not affected and can be used to highlight untrusted text.

Patches

This problem has been fixed in Prism v1.24.

References

  • PrismJS/prism#2774
  • PrismJS/prism#2688

🎯 Affected products1

  • npm/prismjs:< 1.24.0

🔗 References (7)