GHSA-hqhp-5p83-hx96

ghsaUSosv

prismjs Regular Expression Denial of Service vulnerability

view advisory published 2021-09-20Licence: CC-BY-4.0

Prism is a syntax highlighting library. The prismjs package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-3801US	medium6.5	1.04% (64th)	—	2021-09-15
prism is vulnerable to Inefficient Regular Expression Complexity

references

External citations — patches, advisories, analysis.

https://github.com/prismjs/prismPACKAGE
https://github.com/prismjs/prism/commit/0ff371bb4775a131634f47d0fe85794c547232f9WEB
https://huntr.dev/bounties/8c16ab31-6eb6-46d1-b9a4-387222fe1b8aWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-3801ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan