Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2020-26237

Vulnerability in highlight.js (CVE-2020-26237)

Summary

Vulnerability in highlight.js (CVE-2020-26237). Data can be tampered with by attackers. Exploitable via languages. Mitigation: upgrade to 10.1.2 or later.

Original description

The description as published by the source.

Impact

Affected versions of this package are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable.

The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector.

If your website or application does not render user provided data it should be unaffected.

Patches

Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability. If you are using version 7 or 8 you are encouraged to upgrade to a newer release.

Workarounds

Patch your library

Manually patch your library to create null objects for both languages and aliases:

const HLJS = function(hljs) {
  // ...
  var languages = Object.create(null);
  var aliases = Object.create(null);

Filter out bad data from end users:

Filter the language names that users are allowed to inject into your HTML to guarantee they are valid.

References

For more informati…

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2020-26237 has been found in highlight.js.
Attackers can target a specific entry point like languages over the network to misuse the product.
Data can be tampered with by attackers.
What to do: upgrade highlight.js to 10.1.2 or later.
If unsure, ask your IT team or search "highlight.js CVE-2020-26237" on the vendor's site.

CVE-2020-26237 (highlight.js) — CWE-471
Attack vector: remote (network-reachable)
Attack surface: languages / aliases
Patched: 10.1.2 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-471) exists in highlight.js. Attackers reach the vulnerable code path via languages.

📍 Affected scope

Check the vendor advisory for the affected versions of highlight.js. Attack surface: languages / aliases.

🔥 Severity

Severity: ?. Data can be tampered with by attackers.

🔧 How to fix

Update to 10.1.2.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'highlight.js' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'highlight.js' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で highlight.js を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply patch patch 
    Upgrade highlight.js to 10.1.2

    ステージング環境で 10.1.2 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

npm highlight.js
[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.1.2"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details