Executive brief
PrismJS is a popular syntax highlighting library used by web applications and documentation sites. A crafted HTML comment can trigger a ReDoS (regular expression denial of service) attack that causes the application to consume excessive CPU, potentially making the site slow or unresponsive to users.
Technical details
The vulnerability is a regular expression denial of service (ReDoS) in the Markup language component of PrismJS. The vulnerable regex pattern in HTML comment parsing contains catastrophic backtracking that can be triggered by a specially crafted HTML comment input. An attacker who can control HTML input processed by PrismJS (e.g., via user comments, imported content, or markdown processing) can cause the application to hang or consume excessive CPU resources. The fix was patched in version 1.25.0 by correcting the regex pattern to eliminate the backtracking vulnerability.
Affected products
- PrismJS prismjs before 1.25.0
Timeline
- 2021-09-15: disclosed: NVD published
- 2021-09-20: advisory: GitHub Security Advisory published
- 2021-09-16: patched: Fix released in version 1.25.0