CVE-2020-26237: Prototype Pollution in highlight.js
Summary
CVE-2020-26237: Prototype Pollution in highlight.js. Affects highlight.js across 2 version ranges.
< 9.18.2
>= 10.0.0, < 10.1.2
Fixed in 9.18.2 or 10.1.2, depending on the release line you run. How to fix ↓
Also tracked for
- highlight.js · Debian:11
The same CVE-2020-26237 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
highlight.js is an open-source syntax highlighting library used for highlighting code snippets on web pages or in applications. It provides support for a wide range of programming languages and is commonly used by developers to enhance code readability. However, certain versions of highlight.js are vulnerable to Prototype Pollution, a type of vulnerability that can lead to unexpected behavior or application crashes. This vulnerability can be exploited by injecting malicious HTML code blocks that pollute the base object's prototype during highlighting. If user-provided data is not properly filtered, it can result in a potential denial-of-service (DoS) vector. It is important to note that websites or applications that do not render user-provided data are unaffected by this vulnerability.
Vulnerability Detail
The Prototype Pollution vulnerability in highlight.js allows for the pollution of the base object's prototype during code highlighting. By crafting a malicious HTML code block, an attacker can introduce unexpected properties to the prototype, potentially causing strange behavior or application crashes. While the pollution itself is harmless data, it can lead to unintended consequences for applications that are not designed to handle these properties. This vulnerability can be exploited if the application allows users to insert custom HTML code blocks without properly filtering the language names provided. The impact of this vulnerability can range from minor disruptions to potential denial-of-service attacks.
How To Fix
Latest published version: 11.12.0 as of 23 Oct 2026
npm install highlight.js@11.12.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 9.18.29.18.2npm install highlight.js@9.18.2 -
>= 10.0.0, < 10.1.210.1.2npm install highlight.js@10.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are two possible workarounds for this vulnerability:
- Patch your library manually: You can manually patch your highlight.js library by creating null objects for both
languagesandaliases. Here is an example of how to apply the patch:
const HLJS = function(hljs) {
// ...
var languages = Object.create(null);
var aliases = Object.create(null);
- Filter out bad data from end users: To ensure the vulnerability is not exploited, filter the language names that users are allowed to inject into your HTML. By validating and restricting the language names, you can prevent the introduction of malicious code blocks.
Conclusion
The Prototype Pollution vulnerability in highlight.js can lead to unexpected behavior, application crashes, and potential denial-of-service attacks. It is crucial to upgrade to a fixed version of highlight.js (9.18.2 or 10.1.2 and newer) to mitigate this vulnerability. Additionally, filtering user-provided data to prevent the injection of malicious code blocks is recommended. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for highlight.js →
FAQ
Prototype Pollution is a vulnerability that occurs when an attacker is able to inject properties into an object's prototype. This can lead to unexpected behavior or security issues if the application is not designed to handle these properties correctly.
In highlight.js, the Prototype Pollution vulnerability can be exploited by injecting malicious HTML code blocks that pollute the base object's prototype during code highlighting. If the application allows users to insert custom HTML code blocks without proper filtering, the pollution can occur.
The consequences of the Prototype Pollution vulnerability in highlight.js can vary. In some cases, it may result in strange behavior or application crashes. However, the main concern is the potential for a denial-of-service (DoS) vector, where the application becomes unresponsive or crashes due to the unexpected properties introduced by the pollution.
No, not all versions of highlight.js are affected. Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability. If you are using version 7 or 8, it is recommended to upgrade to a newer release to mitigate the risk.
In addition to upgrading to a patched version of highlight.js, it is important to ensure that user-provided data is properly filtered. By validating and restricting the language names that users can inject into HTML code blocks, you can prevent the exploitation of this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for highlight.js.
