Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdqNzctNTl3aC02Nmhn

Regular Expression Denial of Service (ReDoS) in Prism

Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS).

Impact

When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. Do not use the following languages to highlight untrusted text.

• ASCIIDoc
• ERB

Other languages are not affected and can be used to highlight untrusted text.

Patches

This problem has been fixed in Prism v1.24.

References

• PrismJS/prism#2774
• PrismJS/prism#2688

Permalink: https://github.com/advisories/GHSA-gj77-59wh-66hg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWdqNzctNTl3aC02Nmhn
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 3 years ago
Updated: almost 2 years ago

CVSS Score: 7.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

EPSS Percentage: 0.00163
EPSS Percentile: 0.53526

Identifiers: GHSA-gj77-59wh-66hg, CVE-2021-32723
References:

• https://github.com/PrismJS/prism/security/advisories/GHSA-gj77-59wh-66hg
• https://github.com/PrismJS/prism/pull/2688
• https://github.com/PrismJS/prism/pull/2774
• https://github.com/PrismJS/prism/commit/d85e30da6755fdbe7f8559f8e75d122297167018
• https://nvd.nist.gov/vuln/detail/CVE-2021-32723
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://github.com/advisories/GHSA-gj77-59wh-66hg

Repository: https://github.com/PrismJS/prism
Blast Radius: 39.5

Affected Packages