Filtered by vendor Prismjs Subscriptions
Filtered by product Prism Subscriptions
Total 4 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-3801 1 Prismjs 1 Prism 2022-07-29 6.5 Medium
prism is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-32723 2 Oracle, Prismjs 2 Application Express, Prism 2022-03-28 6.5 Medium
Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.
CVE-2022-23647 1 Prismjs 1 Prism 2022-02-28 6.1 Medium
Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted. This bug has been fixed in v1.27.0. As a workaround, do not use the command line plugin on untrusted inputs, or sanitize all code blocks (remove all HTML code text) from all code blocks that use the command line plugin.
CVE-2021-23341 1 Prismjs 1 Prism 2021-02-26 7.5 High
The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.