GHSA-gj77-59wh-66hg
Suggest an improvement- Source
- https://github.com/advisories/GHSA-gj77-59wh-66hg
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-gj77-59wh-66hg/GHSA-gj77-59wh-66hg.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-gj77-59wh-66hg
- Aliases
- Related
- Published
- 2021-06-28T18:33:18Z
- Modified
- 2023-11-08T04:05:58.420925Z
- Severity
-
- 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H CVSS Calculator
- Summary
- Regular Expression Denial of Service (ReDoS) in Prism
- Details
-
Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS).
Impact
When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. Do not use the following languages to highlight untrusted text.
- ASCIIDoc
- ERB
Other languages are not affected and can be used to highlight untrusted text.
Patches
This problem has been fixed in Prism v1.24.
References
- PrismJS/prism#2774
- PrismJS/prism#2688
- Database specific
{ "nvd_published_at": "2021-06-28T20:15:00Z", "github_reviewed_at": "2021-06-28T18:15:20Z", "severity": "HIGH", "github_reviewed": true, "cwe_ids": [ "CWE-400" ] }- References
-
- https://github.com/PrismJS/prism/security/advisories/GHSA-gj77-59wh-66hg
- https://nvd.nist.gov/vuln/detail/CVE-2021-32723
- https://github.com/PrismJS/prism/pull/2688
- https://github.com/PrismJS/prism/pull/2774
- https://github.com/PrismJS/prism/commit/d85e30da6755fdbe7f8559f8e75d122297167018
- https://github.com/PrismJS/prism
- https://www.oracle.com/security-alerts/cpujan2022.html
Affected packages
npm / prismjs
Package
- Name
- prismjs
- View open source insights on deps.dev
- Purl
- pkg:npm/prismjs