GHSA-65xh-hh78-6454

Suggest an improvement
Source
https://github.com/advisories/GHSA-65xh-hh78-6454
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-65xh-hh78-6454/GHSA-65xh-hh78-6454.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-65xh-hh78-6454
Published
2024-05-15T18:03:12Z
Modified
2024-11-29T05:41:25Z
Severity
  • 5.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L/E:F/RL:O/RC:C CVSS Calculator
Summary
Denial of Service in extension "Code Highlight" (codehighlight)
Details

The codehighlight extension bundles a vulnerable version of the 3rd party JavaScript component “prism” which is known to be vulnerable against Regular expression Denial of Service (ReDoS).

Database specific 
{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-05-15T18:03:12Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

Packagist / brotkrueml/codehighlight

Package

Name
brotkrueml/codehighlight
Purl
pkg:composer/brotkrueml/codehighlight

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.7.0

Affected versions

v1.*
v1.0.0
v1.0.1
v1.1.0
v1.1.1
v2.*
v2.0.0
v2.0.1
v2.1.0
v2.2.0
v2.3.0
v2.4.0
v2.5.0
v2.6.0
v2.6.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-65xh-hh78-6454/GHSA-65xh-hh78-6454.json"