Regular Expression Denial of Service (ReDoS) in Prism

Description

Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS).

Recommendation

Update the prismjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.24.0
• Patched version(s): 1.24.0

References

• GHSA-gj77-59wh-66hg
• www.oracle.com
• CVE-2021-32723
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Path Traversal: 'dir/../../filename' in moment.locale - CVE-2022-24785
• Prototype Pollution in lodash (GHSA-jf85-cpcp-j695) 3 - CVE-2019-10744
• Prototype Pollution in lodash (GHSA-jf85-cpcp-j695) 2 - CVE-2019-10744
• PrismJS DOM Clobbering vulnerability - CVE-2024-53382

Tags:

npm

prismjs