Vulnerability record · CVE-2021-23341 · published 18 February 2021

CVE-2021-23341: Prismjs prism vulnerability

PPrismjs · Prism

The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.

7.5 CVSS 3.1 High EPSS 3.2% · top 12.5%

7.5CVSS 3.1 base score, v2 5.0

3.2%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

12References, 8 tagged exploit

17 Jun 2026Last modified by NVD

Description

The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

PPrism Prismjs

References

Link	Tags
https://github.com/PrismJS/prism/commit/c2f6a64426f44497a675cb32dccb079b3eff1609	PatchThird Party Advisory
https://github.com/PrismJS/prism/issues/2583	ExploitPatchThird Party Advisory
https://github.com/PrismJS/prism/pull/2584	PatchThird Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1076583	ExploitThird Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1076582	ExploitThird Party Advisory
https://snyk.io/vuln/SNYK-JS-PRISMJS-1076581	ExploitThird Party Advisory
https://github.com/PrismJS/prism/commit/c2f6a64426f44497a675cb32dccb079b3eff1609	PatchThird Party Advisory
https://github.com/PrismJS/prism/issues/2583	ExploitPatchThird Party Advisory
https://github.com/PrismJS/prism/pull/2584	PatchThird Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1076583	ExploitThird Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1076582	ExploitThird Party Advisory
https://snyk.io/vuln/SNYK-JS-PRISMJS-1076581	ExploitThird Party Advisory

Track CVE-2021-23341 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.5CVE-2021-3801Prismjs prism inefficient regular expression (redos) vulnerabilityprism is vulnerable to Inefficient Regular Expression ComplexityEPSS 1.0%15 Sep 2021 6.5CVE-2021-32723Prismjs prism uncontrolled resource consumption vulnerabilityPrism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is us…EPSS 1.4%28 Jun 2021 6.1CVE-2022-23647Prismjs prism cross-site scripting vulnerabilityPrism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attacker…EPSS 1.5%18 Feb 2022 5.4CVE-2024-53382Prismjs prism code injection vulnerabilityPrism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain Jav…EPSS 0.34%3 Mar 2025

Source: NIST National Vulnerability Database (record CVE-2021-23341), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.