GHSA-hqhp-5p83-hx96

prismjs Regular Expression Denial of Service vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-3801

Packages

Ecosystem	Package	Affected	Fixed in
npm	prismjs	< 1.25.0	1.25.0

Details

As written in the advisory (Markdown source, shown as plain text).

Prism is a syntax highlighting library. The prismjs package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-3801 advisory
https://github.com/prismjs/prism/commit/0ff371bb4775a131634f47d0fe85794c547232f9 web
https://github.com/prismjs/prism package
https://huntr.dev/bounties/8c16ab31-6eb6-46d1-b9a4-387222fe1b8a web