Vulnerability · Published Jun 28, 2021 · Assigned by GitHub_M
CVE-2021-32723Regular Expression Denial of Service (ReDoS) in Prism
High 7.4
In plain English
A high-severity uncontrolled resource consumption in prism from PrismJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | node-prismjs | no fix listed | UBUNTU-CVE-2021-32723 |
| Ubuntu:24.04:LTS | node-prismjs | no fix listed | UBUNTU-CVE-2021-32723 |
| Ubuntu:25.10 | node-prismjs | no fix listed | UBUNTU-CVE-2021-32723 |
| Ubuntu:26.04:LTS | node-prismjs | no fix listed | UBUNTU-CVE-2021-32723 |
| Ubuntu:26.10 | node-prismjs | no fix listed | UBUNTU-CVE-2021-32723 |
| npm | prismjs | 1.24.0 | GHSA-gj77-59wh-66hg |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
References
- https://github.com/PrismJS/prism/security/advisories/GHSA-gj77-59wh-66hg x_refsource_CONFIRM
- https://github.com/PrismJS/prism/pull/2688 x_refsource_MISC
- https://github.com/PrismJS/prism/pull/2774 x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC