Executive brief
Highlight.js is a popular code syntax highlighting library used on websites and applications to render source code. Multiple language grammar definitions in this library contain regular expressions vulnerable to Regular Expression Denial of Service (ReDoS) attacks. An attacker can provide specially crafted code snippets that cause the highlighter to consume excessive CPU resources, freezing browser tabs, crashing applications, or taking servers offline—effectively disrupting service availability.
Technical details
The vulnerability exists in regular expression patterns within language grammar definitions shipped with highlight.js versions prior to 10.4.1. These patterns suffer from exponential or polynomial backtracking when processing certain input sequences. Affected grammars include C, C++, JavaScript, Perl, Ruby, YAML, and many others. Attack vectors include: (1) client-side via browser rendering of malicious code blocks (freezing or crashing the page), and (2) server-side when the library is used to process user-supplied content (causing indefinite processing). No authentication is required; the attacker only needs the library to process their input. Patches are available in version 10.4.1 and later.
Affected products
- highlight.js highlight.js 9.0.0 to 10.4.0
- highlight.js @highlightjs/cdn-assets before 10.4.1
Timeline
- 2020-12-04: disclosed: GHSA-7wwv-vh3v-89cq advisory published
- 2020-12-04: patched: Version 10.4.1 released with fixes