Executive brief
Microlight is a JavaScript library used for syntax highlighting in web pages. A denial of service vulnerability allows attackers to crash or freeze browsers by forcing the library to process excessively large text content, potentially affecting users who visit malicious websites. This advisory has been withdrawn due to lack of demonstrated practical impact.
Technical details
The vulnerability is a denial of service (CWE-770: Allocation of Resources Without Limits or Throttling) in microlight v0.0.7, where the reset function fails to limit the size of textual content processed from HTML elements with the microlight class. An attacker can supply extremely large input (e.g., 100 million characters) to trigger excessive memory and CPU consumption, causing browser crashes or unresponsiveness. The attack vector is network-based and requires user interaction (user must visit a malicious page). The advisory was withdrawn on 2025-06-18 because the proof of concept does not demonstrate practical security impact.
Affected products
- microlight contributors microlight 0.0.7 and prior
Timeline
- 2025-06-17: disclosed
- 2025-06-18: advisory: Advisory withdrawn due to lack of practical security impact