Read the docs
TI-2020-16058 Aliases CVE-2020-26237GHSA-vfrc-7r7c-w9mx

Prototype Pollution in highlight.js

Priority MEDIUM 40CWE-471Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector. If your website or application does not render user provided data it should be unaffected. Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability. If you are using version 7 or 8 you are encouraged to upgrade to a newer release.

Why it matters now

EPSS 0.01329 71st percentileScored 2026-11-07
Fix Fixed highlight.js (highlightjs): 9.18.2, 10.1.2highlight.js (npm): 9.18.2, 10.1.2Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
highlightjshighlight.jsbefore 9.18.2; 10.0.0 to before 10.1.29.18.2, 10.1.2Patch availableCNA
—highlight.js (npm)before 9.18.29.18.2Patch availableGHSA-vfrc-7r7c-w9mx
—highlight.js (npm)10.0.0 to before 10.1.210.1.2Patch availableGHSA-vfrc-7r7c-w9mx
  • highlight.js Vendorhighlightjs Affected before 9.18.2; 10.0.0 to before 10.1.2 Fixed in 9.18.2, 10.1.2 Patch available CNA
  • highlight.js (npm) Vendor— Affected before 9.18.2 Fixed in 9.18.2 Patch available GHSA-vfrc-7r7c-w9mx
  • highlight.js (npm) Vendor— Affected 10.0.0 to before 10.1.2 Fixed in 10.1.2 Patch available GHSA-vfrc-7r7c-w9mx

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:highlightjs:highlight.js:*:*:*:*:*:node.js:*:*before 9.18.2; 10.1.0 to before 10.1.2Vulnerablehighlightjs
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*up to 8.0.30VulnerableOracle
  • cpe:2.3:a:highlightjs:highlight.js:*:*:*:*:*:node.js:*:* Versions before 9.18.2; 10.1.0 to before 10.1.2 Vulnerable ·highlightjs
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 8.0.30 Vulnerable ·Oracle

Remediation

  • Fix · CNA highlight.js (highlightjs) Fixed in 9.18.2, 10.1.2
  • Fix · GHSA-vfrc-7r7c-w9mx highlight.js (npm) Fixed in 9.18.2 Advisory →
  • Fix · GHSA-vfrc-7r7c-w9mx highlight.js (npm) Fixed in 10.1.2 Advisory →

Red Hat 1 advisory

  • RHSA-2021:3917 Released 2021-10-19 · Red Hat rating Important
    Red Hat Quay v3.6.0 security, bug fix and enhancement update
    • Quay v3 quay/quay-rhel8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Quay v3Fixed RHSA-2021:3917
Not affected: 2 products
  • Logging Subsystem for Red Hat OpenShift
  • Quay v3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26237
  2. 2026-10-03 Alias added: GHSA-vfrc-7r7c-w9mx

References

Patch 2

Advisory 5

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences