WaratekVRT Sign in

CVE-2020-26237 Highlight.js

Affected softwareHighlight.js
Severity8.7 High CVSS 3.1 3 scores
WeaknessCWE-471
Published24 Nov 2020
Updated17 Jun 2026

Description

Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector. If your website or application does not render user provided data it should be unaffected. Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability. If you are using version 7 or 8 you are encouraged to upgrade to a newer release.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 5 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 1.3% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

8.7 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 8.7 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H NVD Primary published
CVSS 3.1 5.8 MEDIUM CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N security-advisories@github.com Secondary
CVSS 2.0 4.9 none AV:N/AC:M/Au:S/C:N/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2022 ↗ CPU 2022-Q3 Oracle MySQL / Monitoring: General (highlight.js) (8.0.30 and prior)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle MySQL Monitoring: General (highlight.js) 8.0.30 and prior

Products and versions

3 products, 4 version entries
SourceVendorProductSchemeAffected versions
nvd debian debian linux generic 9.0
nvd highlightjs highlight.js generic ＜ 9.18.2 · ≥ 10.1.0 and ＜ 10.1.2
nvd oracle mysql enterprise monitor generic ≤ 8.0.30

References

URLTags
https://github.com/highlightjs/highlight.js/commit/7241013ae011a585983e176ddc0489a7a52f6bb0 Patch, Third Party Advisory
https://github.com/highlightjs/highlight.js/pull/2636 Patch, Third Party Advisory
https://github.com/highlightjs/highlight.js/security/advisories/GHSA-vfrc-7r7c-w9mx Mitigation, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00041.html Mailing List, Third Party Advisory
https://www.npmjs.com/package/highlight.js Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Third Party Advisory

Timeline
Published2020-11-24By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.