prismjs Regular Expression Denial of Service vulnerability

Description

Prism is a syntax highlighting library. The prismjs package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU.

Recommendation

Update the prismjs package to the latest compatible version. Followings are version details:

Affected version(s): < 1.25.0
Patched version(s): 1.25.0

References

GHSA-hqhp-5p83-hx96
huntr.dev
CVE-2021-3801
CWE-400
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for prismjs Regular Expression Denial of Service vulnerability and gives you actionable findings to investigate.

Start a free scan

Related Issues

Regular Expression Denial of Service (ReDoS) in Prism - CVE-2021-32723
Regular Expression Denial of Service (ReDoS) - ssri - CVE-2021-27290
tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability - CVE-2026-22809
html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) - CVE-2021-23346

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

See something that needs correcting? Let us knowUpdated January 29, 2023