~ / search / GHSA-gj77-59wh-66hg

GHSA-gj77-59wh-66hg

Regular Expression Denial of Service (ReDoS) in Prism

Source: GitHub Advisory Database (reviewed) High CVE-2021-32723

Packages

EcosystemPackageAffectedFixed in
npm prismjs < 1.24.0 1.24.0

Details

As written in the advisory (Markdown source, shown as plain text).

Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). ### Impact When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. Do not use the following languages to highlight untrusted text. - ASCIIDoc - ERB Other languages are __not__ affected and can be used to highlight untrusted text. ### Patches This problem has been fixed in Prism v1.24. ### References - PrismJS/prism#2774 - PrismJS/prism#2688

References

External links from the advisory. They lead to third-party sites.