Prototype Pollution Vulnerability in Highlight.js - CVE-2020-26237
Summary
CVE-2020-26237: Highlight.js is a syntax highlighter written in JavaScript. Affects highlight.js across 2 version ranges.
< 9.18.1+dfsg1-3
< 7241013ae011a585983e176ddc0489a7a52f6bb0
Fixed in 9.18.1+dfsg1-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Highlight.js is a popular syntax highlighter written in JavaScript, widely used to enhance the readability of code snippets in web applications. It supports a variety of programming languages and is known for its ease of use and integration. However, certain versions of Highlight.js are vulnerable to a prototype pollution issue that can lead to unexpected behavior in applications that allow user-generated content.
Vulnerability Detail
The vulnerability, identified as CVE-2020-26237, arises from the ability of a malicious user to craft specific HTML code blocks that exploit the prototype pollution feature of Highlight.js. This occurs when the library processes user input without proper validation, allowing harmful properties to be added to the base object's prototype. While the immediate impact may seem benign, it can lead to application crashes or unpredictable behavior, especially in systems that do not anticipate these additional properties. The affected versions are those prior to 9.18.2 and 10.1.2.
How To Fix
Minimum fixed version
9.18.1+dfsg1-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade highlight.jsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider implementing input validation to filter out potentially harmful language names provided by users. This can be done by sanitizing user input before it is processed by Highlight.js. For example, you can restrict the allowed language names to a predefined list:
Conclusion
CVE-2020-26237 is a significant vulnerability in Highlight.js that can lead to prototype pollution if user input is not properly validated. Upgrading to the latest version is the best course of action to mitigate this risk. Additionally, using tools like Vulert can help you monitor and manage vulnerabilities in your applications effectively.
See every vulnerability recorded for highlight.js →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to manipulate the prototype of a base object, potentially leading to unexpected behavior in applications.
Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to this issue.
The vulnerability can lead to application crashes, unexpected behavior, or even denial of service (DOS) if the application does not handle the polluted properties correctly.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can receive real-time alerts about vulnerabilities.
The CVSS score for CVE-2020-26237 is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for highlight.js.
