← Vulnerability feed
Start free
Open in platform
Vulnerability record · CVE-2021-3801 · published 15 September 2021
CVE-2021-3801: Prismjs prism inefficient regular expression (redos) vulnerability
PPrismjs · Prism
prism is vulnerable to Inefficient Regular Expression Complexity
6.5 CVSS 3.1 Medium EPSS 1.0% · top 37.4% CWE-1333 · Inefficient regular expression (ReDoS)
6.5CVSS 3.1 base score, v2 4.3
1.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD
Description
prism is vulnerable to Inefficient Regular Expression Complexity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/prismjs/prism/commit/0ff371bb4775a131634f47d0fe85794c547232f9 | PatchThird Party Advisory |
| https://huntr.dev/bounties/8c16ab31-6eb6-46d1-b9a4-387222fe1b8a | ExploitIssue TrackingPatchThird Party Advisory |
| https://github.com/prismjs/prism/commit/0ff371bb4775a131634f47d0fe85794c547232f9 | PatchThird Party Advisory |
| https://huntr.dev/bounties/8c16ab31-6eb6-46d1-b9a4-387222fe1b8a | ExploitIssue TrackingPatchThird Party Advisory |
Track CVE-2021-3801 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
7.5CVE-2021-23341Prismjs prism vulnerabilityThe package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and pr…EPSS 3.2%6.5CVE-2021-32723Prismjs prism uncontrolled resource consumption vulnerabilityPrism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is us…EPSS 1.4%6.1CVE-2022-23647Prismjs prism cross-site scripting vulnerabilityPrism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attacker…EPSS 1.5%5.4CVE-2024-53382Prismjs prism code injection vulnerabilityPrism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain Jav…EPSS 0.34%
Source: NIST National Vulnerability Database (record CVE-2021-3801), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.
