CVE-2021-23341

The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 87%
Affected Products (NVD)
VendorProductVersion
prismjsprism
𝑥
< 1.23.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
node-prismjs
bookworm
1.29.0+dfsg+~1.26.0-1
fixed
bullseye
1.23.0+dfsg-1+deb11u2
fixed
sid
1.29.0+dfsg+~1.26.0-1
fixed
trixie
1.29.0+dfsg+~1.26.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
node-prismjs
bionic
dne
focal
needed
groovy
ignored
hirsute
ignored
impish
ignored
jammy
needed
kinetic
ignored
lunar
ignored
mantic
ignored
noble
needed
oracular
ignored
plucky
ignored
questing
ignored
resolute
needed
trusty
dne
xenial
dne
References
https://github.com/PrismJS/prism/commit/c2f6a64426f44497a675cb32dccb079b3eff1609
https://github.com/PrismJS/prism/issues/2583
https://github.com/PrismJS/prism/pull/2584
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1076583
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1076582
https://snyk.io/vuln/SNYK-JS-PRISMJS-1076581
https://github.com/PrismJS/prism/commit/c2f6a64426f44497a675cb32dccb079b3eff1609
https://github.com/PrismJS/prism/issues/2583
https://github.com/PrismJS/prism/pull/2584
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1076583
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1076582
https://snyk.io/vuln/SNYK-JS-PRISMJS-1076581