Executive brief
Prism is a popular syntax highlighting library used to format code snippets on websites. A regular expression flaw allows attackers to craft malicious input strings that consume excessive CPU time when processed for syntax highlighting, potentially causing service outages. This affects only the ASCIIDoc and ERB language definitions; other languages are safe.
Technical details
This is a regular expression denial of service (ReDoS) vulnerability in the syntax highlighting engine of Prism versions before 1.24.0. The vulnerable patterns are in the ASCIIDoc and ERB language definitions, which contain inefficient regex patterns prone to catastrophic backtracking when processing untrusted input. When an attacker provides a carefully crafted string to be highlighted, the regex engine enters a state of exponential backtracking, consuming CPU resources for an extended period. The vulnerability requires the attacker to control the text being highlighted, which is a realistic scenario when syntax highlighting user-submitted code. The issue has been patched in Prism v1.24.0.
Affected products
- PrismJS Prism <1.24.0
Timeline
- 2021-06-28: disclosed
- 2021-06-28: patched: Fixed in v1.24.0