PT-2020-6570 · Unknown+3 · Highlight.Js+3

Published 2020-11-24 · Updated 2026-05-19 · CVE-2020-26237

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Highlight.js versions prior to 9.18.2 Highlight.js versions prior to 10.1.2

Description The issue is related to prototype pollution, which can occur when a malicious HTML code block is crafted, resulting in the pollution of the base object's prototype during highlighting. This can cause problems for applications not expecting these properties to exist, leading to strange behavior or application crashes, and potentially serving as a DOS vector. If a website or application does not render user-provided data, it should be unaffected.

Recommendations For versions prior to 9.18.2, upgrade to version 9.18.2 or newer. For versions prior to 10.1.2, upgrade to version 10.1.2 or newer. For versions 7 or 8, upgrade to a newer release. As a temporary workaround, consider manually patching the library to create null objects for both languages and aliases. Filter the language names that users are allowed to inject into HTML to guarantee they are valid.

Fix

DoS

Weakness Enumeration

CWE-471

Related Identifiers

BDU:2022-00249

CVE-2020-26237

DLA-2511-1

GHSA-VFRC-7R7C-W9MX

USN-8276-1

Affected Products

Astra Linux

Highlight.Js

Linuxmint

Ubuntu

References · 23

• https://github.com/highlightjs/highlight.js/commit/7241013ae011a585983e176ddc0489a7a52f6bb0 · Patch
• https://github.com/highlightjs/highlight.js/pull/2636 · Patch
• https://ubuntu.com/security/CVE-2020-26237 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-26237 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26237 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8276-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26237 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00249 · Security Note
• https://osv.dev/vulnerability/GHSA-vfrc-7r7c-w9mx · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-26237 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-26237 · Security Note
• https://osv.dev/vulnerability/DLA-2511-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-26237 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8276-1 · Vendor Advisory