Prototype Pollution in highlight.js
Summary
DLA-2511-1: highlight.js - security update. Affects highlight.js versions < 8.2+ds-5+deb9u1. Fixed in 8.2+ds-5+deb9u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
highlight.js is a JavaScript library used for syntax highlighting in websites and applications. It provides a way to dynamically highlight code snippets in various programming languages. The library is widely used and integrated into many web projects.
Vulnerability Detail
The highlighted.js library is vulnerable to Prototype Pollution. This type of vulnerability occurs when user-provided data is not properly sanitized before being rendered by the application. An attacker can exploit this vulnerability to inject malicious properties into the prototype of an object, leading to unexpected behavior or crashes in applications that do not handle unknown properties correctly.
How To Fix
Minimum fixed version
8.2+ds-5+deb9u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade highlight.jsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is crucial to update the highlight.js package to the fixed version to mitigate the risk of exploitation.
Conclusion
The highlight.js library is vulnerable to Prototype Pollution, which can be exploited to inject malicious properties into objects. To mitigate this risk, it is crucial to update the highlight.js package to version 8.2+ds-5+deb9u1 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for highlight.js →
FAQ
highlight.js is a JavaScript library used for syntax highlighting in web applications. It provides a simple way to highlight code snippets in various programming languages.
Prototype Pollution is a vulnerability that occurs when user-provided data is not properly sanitized before being used to modify the prototype of an object. This can lead to unexpected behavior or crashes in applications that do not handle unknown properties correctly.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for open-source vulnerabilities, including this one.
Yes, a fix is available for this vulnerability. You should update the highlight.js package to version 8.2+ds-5+deb9u1 or later to mitigate the risk of exploitation.
You can find more information about this vulnerability in the Debian Security Tracker page for highlight.js: https://security-tracker.debian.org/tracker/highlight.js
Related vulnerabilities
Recent vulnerabilities recorded for highlight.js.
