Executive brief
microlight.js is a lightweight syntax highlighting library used in web applications to colorize code. A null pointer dereference vulnerability could cause the library to crash when processing malformed CSS color values, resulting in denial of service. However, this advisory was withdrawn because the vulnerability requires the website owner to set the problematic CSS values, limiting practical exploitability by external attackers.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in microlight.js version 0.0.7 and earlier. The library fails to validate the result of a regular expression match before accessing its properties when processing CSS color values, leading to an uncaught TypeError. The attack requires network access but is constrained by high privileges (website owner must set the CSS configuration) and requires user interaction. An attacker who can control CSS color configuration can trigger an application crash. The advisory was withdrawn on 2025-06-18 after determining that the practical attack surface is limited to scenarios where a website owner deliberately sets malicious CSS values.
Affected products
- asvd microlight.js 0.0.7 and earlier
Timeline
- 2025-06-17: disclosed
- 2025-06-18: other: Advisory withdrawn by maintainers due to limited practical exploitability
- 2025-06-17: other: CVE-2025-45525 published