Regular Expression Denial of Service (ReDoS) in Prism

Description

Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS).

Recommendation

Update the prismjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.24.0
• Patched version(s): 1.24.0

References

• GHSA-gj77-59wh-66hg
• www.oracle.com
• CVE-2021-32723
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Prototype Pollution in lodash (GHSA-jf85-cpcp-j695) 4 - CVE-2019-10744
• Prototype Pollution in lodash (GHSA-jf85-cpcp-j695) 2 - CVE-2019-10744
• PrismJS DOM Clobbering vulnerability - CVE-2024-53382
• Passbolt Browser Extension leaks password information - CVE-2024-33669

Tags:

npm

prismjs