CVE-2021-32723

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
PrismJS	prism	< 1.24

References

https://github.com/PrismJS/prism/pull/2688Patch, Third Party Advisory
https://github.com/PrismJS/prism/pull/2774Patch, Third Party Advisory
https://github.com/PrismJS/prism/security/advisories/GHSA-gj77-59wh-66hgThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
https://github.com/PrismJS/prism/pull/2688Patch, Third Party Advisory
https://github.com/PrismJS/prism/pull/2774Patch, Third Party Advisory
https://github.com/PrismJS/prism/security/advisories/GHSA-gj77-59wh-66hgThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory

Timeline

Published: Jun 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327249.9check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the [check-spelling actio CVE-2021-327255.3Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, default share permissio CVE-2021-327269.8Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were no CVE-2021-327277.5Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public CVE-2021-327286.5The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end en CVE-2021-327295.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions CVE-2021-32737.2Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someon CVE-2021-327305.7XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulner CVE-2021-327315.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13 CVE-2021-327326.5### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually ti CVE-2021-327336.1Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versio CVE-2021-327345.3Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text appl