Candidate: CVE-2020-26237
PublicDate: 2020-11-24 23:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26237
 https://github.com/highlightjs/highlight.js/commit/7241013ae011a585983e176ddc0489a7a52f6bb0
 https://github.com/highlightjs/highlight.js/pull/2636
 https://github.com/highlightjs/highlight.js/security/advisories/GHSA-vfrc-7r7c-w9mx
 https://www.npmjs.com/package/highlight.js
Description:
 Highlight.js is a syntax highlighter written in JavaScript. Highlight.js
 versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A
 malicious HTML code block can be crafted that will result in prototype
 pollution of the base object's prototype during highlighting. If you allow
 users to insert custom HTML code blocks into your page/app via parsing
 Markdown code blocks (or similar) and do not filter the language names the
 user can provide you may be vulnerable. The pollution should just be
 harmless data but this can cause problems for applications not expecting
 these properties to exist and can result in strange behavior or application
 crashes, i.e. a potential DOS vector. If your website or application does
 not render user provided data it should be unaffected. Versions 9.18.2 and
 10.1.2 and newer include fixes for this vulnerability. If you are using
 version 7 or 8 you are encouraged to upgrade to a newer release.
Ubuntu-Description:
Notes:
Mitigation:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N [6.8 MEDIUM]


Patches_highlight.js:
upstream_highlight.js: needs-triage
precise/esm_highlight.js: DNE
trusty_highlight.js: ignored (out of standard support)
trusty/esm_highlight.js: DNE
xenial_highlight.js: ignored (end of standard support, was needs-triage)
bionic_highlight.js: needs-triage
focal_highlight.js: needs-triage
groovy_highlight.js: ignored (reached end-of-life)
hirsute_highlight.js: ignored (reached end-of-life)
impish_highlight.js: needs-triage
jammy_highlight.js: needs-triage
devel_highlight.js: needs-triage