Regular Expression Denial of Service (ReDoS) in Prism

中 6.5CVE-2021-32723 · GHSA-gj77-59wh-66hg · 28/06/2021 公開 · 17/06/2026 更新

要点

CVE-2021-32723 は application express (oracle), prism (prismjs), prismjs に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.4%（全脆弱性の 72.9% より高い）。
対処：21.1.4, 1.24.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
application express oracle	`< 21.1.4`	`21.1.4`
prism prismjs	`< 1.24.0`	`1.24.0`
prismjs npm	`< 1.24.0`	`1.24.0`

概要

Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS).

Impact

When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. Do not use the following languages to highlight untrusted text.

ASCIIDoc
ERB

Other languages are not affected and can be used to highlight untrusted text.

Patches

This problem has been fixed in Prism v1.24.

References

PrismJS/prism#2774
PrismJS/prism#2688

NVD の説明

Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.