CVE-2021-23341: Regular Expression Denial of Service (ReDoS)
First published: Thu Feb 18 2021(Updated: )
The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `prism-asciidoc`, `prism-rest`, `prism-tap` and `prism-eiffel` components.
Credit: report@snyk.io report@snyk.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/prismjs | <1.23.0 | 1.23.0 |
| Prismjs Prism | <1.23.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2021-23341
- https://github.com/PrismJS/prism/issues/2583
- https://github.com/PrismJS/prism/pull/2584
- https://github.com/PrismJS/prism/commit/c2f6a64426f44497a675cb32dccb079b3eff1609
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1076583
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1076582
- https://snyk.io/vuln/SNYK-JS-PRISMJS-1076581
- https://www.npmjs.com/package/prismjs
- https://github.com/advisories/GHSA-h4hr-7fg3-h35w (Advisory)
Frequently Asked Questions
What is CVE-2021-23341?
CVE-2021-23341 is a vulnerability in the package prismjs before version 1.23.0 that allows Regular Expression Denial of Service (ReDoS) attacks.
What is Regular Expression Denial of Service (ReDoS)?
Regular Expression Denial of Service (ReDoS) is a type of vulnerability where a maliciously crafted input can cause a regular expression to consume significant amount of time, leading to denial of service.
How does CVE-2021-23341 affect prismjs?
CVE-2021-23341 affects prismjs before version 1.23.0, specifically impacting the `prism-asciidoc`, `prism-rest`, `prism-tap`, and `prism-eiffel` components.
What is the severity rating of CVE-2021-23341?
CVE-2021-23341 has a severity rating of 7.5 (high).
How can I fix the vulnerability CVE-2021-23341?
To fix the vulnerability CVE-2021-23341, update the prismjs package to version 1.23.0 or later.
- collector/github-advisory-latest
- alias/GHSA-h4hr-7fg3-h35w
- alias/CVE-2021-23341
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/author
- agent/type
- agent/softwarecombine
- agent/severity
- agent/remedy
- agent/references
- agent/weakness
- agent/description
- agent/title
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/trending
- package-manager/npm
- vendor/prismjs
- canonical/prismjs prism