CVE-2021-32723

HIGH

Prism < 1.24.0 - Regular Expression Denial of Service in ASCIIDoc and ERB Highlighters

Title source: llm
STIX 2.1

Description

Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.

References (4)

Core 4
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/PrismJS/prism/pull/2688
Patch, Third Party Advisory x_refsource_misc
https://github.com/PrismJS/prism/pull/2774
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujan2022.html

Scores

CVSS v3 7.4
EPSS 0.0037
EPSS Percentile 59.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Details

CWE
CWE-400
Status published
Products (3)
npm/prismjs 0 - 1.24.0npm
oracle/application_express < 21.1.4
prismjs/prism < 1.24.0
Published Jun 28, 2021
Tracked Since Feb 18, 2026