Executive brief
PrismJS is a popular syntax highlighting library used to display code on websites. Multiple regular expression vulnerabilities allow attackers to cause the application to freeze or crash by providing specially crafted code snippets. This can disrupt user access to affected websites or applications that use PrismJS for code display.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) affecting multiple language components in PrismJS (prism-asciidoc, prism-rest, prism-tap, prism-eiffel, prism-batch). The root cause is the use of inefficient regular expressions with catastrophic backtracking behavior. An attacker can exploit this by submitting crafted code strings to syntax highlighting operations, causing excessive CPU consumption and application unresponsiveness. No authentication is required; the attack surface depends on whether user-supplied code is processed by PrismJS. The vulnerability was fixed in version 1.23.0.
Affected products
- PrismJS PrismJS before 1.23.0
Timeline
- 2021-02-18: disclosed: NVD publication date
- 2021-03-01: disclosed: GitHub advisory publication date
- 2021-03-01: patched: Fixed in version 1.23.0
- 2021-02-24: other: GitHub reviewed and confirmed vulnerability