CVE-2020-26237

unknown

Published 2020-11-24 · Modified 2026-03-13

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N

CVSS v4 NEW

—

not yet in upstream

VIR risk

—

Description

Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector. If your website or application does not render user provided data it should be unaffected. Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability. If you are using version 7 or 8 you are encouraged to upgrade to a newer release.

Predictions

Exploit likelihood

30%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2020-26237 NameCVE-2020-26237 DescriptionHighlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app…

CVE-2020-26237

Name	CVE-2020-26237
Description	Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector. If your website or application does not render user provided data it should be unaffected. Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability. If you are using version 7 or 8 you are encouraged to upgrade to a newer release.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2511-1
Debian Bugs	976446

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
highlight.js (PTS)	bullseye	9.18.5+dfsg1-1	fixed
	bookworm, trixie	9.18.5+dfsg1-2	fixed
	forky	10.7.3+dfsg-4	fixed
	sid	10.7.3+dfsg-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
highlight.js	source	stretch	8.2+ds-5+deb9u1	DLA-2511-1
highlight.js	source	buster	9.12.0+dfsg1-4+deb10u1
highlight.js	source	(unstable)	9.18.1+dfsg1-3		976446

Notes

https://github.com/highlightjs/highlight.js/security/advisories/GHSA-vfrc-7r7c-w9mx
https://github.com/highlightjs/highlight.js/pull/2636
https://github.com/highlightjs/highlight.js/commit/7241013ae011a585983e176ddc0489a7a52f6bb0

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

https://github.com/highlightjs/highlight.js/security/advisories/GHSA-vfrc-7r7c-w9mxhttps://github.com/highlightjs/highlight.js/pull/2636https://github.com/highlightjs/highlight.js/commit/7241013ae011a585983e176ddc0489a7a52f6bb0

OS impact

OS	Version	Status	Fixed in
debian	bookworm	fixed	`9.18.1+dfsg1-3`
debian	bullseye	fixed	`9.18.1+dfsg1-3`
debian	forky	fixed	`9.18.1+dfsg1-3`
debian	sid	fixed	`9.18.1+dfsg1-3`
debian	trixie	fixed	`9.18.1+dfsg1-3`

Package impact

Ecosystem	Package	Vulnerable	Fixed
npm	highlight.js	`<9.18.2`	`9.18.2`
npm	highlight.js	`>=10.0.0,<10.1.2`	`10.1.2`

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.