medium6.5
CVE-2021-3801
prismjs Regular Expression Denial of Service vulnerability
Impact
Prism is a syntax highlighting library. The prismjs package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | prismjs | < 1.25.0 | 1.25.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Prismjs | Prism | before 1.25.0 |