CVE-2021-32723: Uncontrolled Resource Consumption

June 28, 2021 (updated March 28, 2022)

Prism is a syntax highlighting library. Some languages is vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.

References

nvd.nist.gov/vuln/detail/CVE-2021-32723

Code Behaviors & Features

Detect and mitigate CVE-2021-32723 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →