CVSS: 8.7EPSS: 0%CPEs: 4EXPL: 0CVE-2020-26237 – Prototype Pollution in highlight.js
https://notcve.org/view.php?id=CVE-2020-26237
Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector. • https://github.com/highlightjs/highlight.js/commit/7241013ae011a585983e176ddc0489a7a52f6bb0 https://github.com/highlightjs/highlight.js/pull/2636 https://github.com/highlightjs/highlight.js/security/advisories/GHSA-vfrc-7r7c-w9mx https://lists.debian.org/debian-lts-announce/2020/12/msg00041.html https://www.npmjs.com/package/highlight.js https://www.oracle.com/security-alerts/cpujul2022.html https://access.redhat.com/security/cve/CVE-2020-26237 https://bugzilla.redhat.com/show_bug.cgi?id=1901662 • CWE-20: Improper Input Validation CWE-471: Modification of Assumed-Immutable Data (MAID) •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-7773 – Cross-site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2020-7773
This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require("markdown-it-highlightjs"); const md = require('markdown-it'); const reuslt_xss = md() .use(markdownItHighlightjs, { inline: true }) .render('console.log(42){.">js}'); console.log(reuslt_xss); Esto afecta al paquete markdown-it-highlightjs versiones anteriores a 3.3.1. Es posible insertar JavaScript malicioso como valor de lang en la funcionalidad de resaltado de código en línea markdown-it-highlightjs. const markdownItHighlightjs = require("markdown-it-highlightjs"); const md = require("markdown-it"); const reuslt_xss = md() .use(markdownItHighlightjs, {inline: true}) .render("console.log(42){.")js}'); console.log(reuslt_xss) • https://github.com/valeriangalliat/markdown-it-highlightjs/blob/v3.3.0/index.js%23L52 https://github.com/valeriangalliat/markdown-it-highlightjs/pull/14 https://snyk.io/vuln/SNYK-JS-MARKDOWNITHIGHLIGHTJS-1040461 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 1CVE-2019-12934 – WP Code Highlight.js <= 0.6.2 - Cross-Site Request Forgery to Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-12934
An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter. Se detectó un problema en el plugin wp-code-highlightjs hasta versión 0.6.2 para WordPress. wp-admin/options-general.php?page=wp-code-highlight-js permite un vulnerabilidad de tipo CSRF, como es demostrado por una carga útil de tipo XSS en el parámetro hljs_additional_css. The WP Code Highlight.js plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.6.2. • http://www.securityfocus.com/bid/109331 https://wordpress.org/plugins/wp-code-highlightjs/#developers https://zeroauth.ltd/blog/2019/07/17/cve-2019-12934-wp-code-highlightjs-wordpress-plugin-csrf-leads-to-blog-wide-injected-script-html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-352: Cross-Site Request Forgery (CSRF) •