Every CVESearch/Get API key

GHSA-4cv2-xc5f-px8h

Denial of Service in extension "Code Highlight" (codehighlight)

5.0 MediumFix available

The codehighlight extension bundles a vulnerable version of the 3rd party JavaScript component “prism” which is known to be vulnerable against Regular expression Denial of Service (ReDoS).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

What each source reports

GitHub Advisories Score used5.0

Denial of Service in extension "Code Highlight" (codehighlight)

The codehighlight extension bundles a vulnerable version of the 3rd party JavaScript component “prism” which is known to be vulnerable against Regular expression Denial of Service (ReDoS).

Record
GHSA-4cv2-xc5f-px8h
CVSS 3.1
5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Updated
2026-11-02
OSV5.0

Denial of Service in extension "Code Highlight" (codehighlight)

The codehighlight extension bundles a vulnerable version of the 3rd party JavaScript component “prism” which is known to be vulnerable against Regular expression Denial of Service (ReDoS).

Record
GHSA-4cv2-xc5f-px8h
CVSS 3.1
5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
brotkrueml/codehighlight
Packagist
before 2.5.0
2.5.0
brotkrueml/codehighlight
Packagist
before 2.5.0, plus listed versions
v1.0.0v1.0.1v1.1.0v1.1.1v2.0.0
Show 5 moreShow less
v2.0.1v2.1.0v2.2.0v2.3.0v2.4.0
2.5.0

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-4cv2-xc5f-px8h is a medium vulnerability (CVSS 5.0) in brotkrueml/codehighlight, published May 15, 2024. No source lists public exploit code. Fixed in brotkrueml/codehighlight 2.5.0.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open