pygments

About this tag
Pygments is a Python syntax-highlighting library widely used in web applications, documentation tools, and code-review systems. Recent discussions on WindowsForum highlight two security vulnerabilities affecting Pygments: a Regular Expression Denial of Service (ReDoS) caused by exponential or cubic backtracking in lexer regex patterns, and CVE-2021-20270, an infinite-loop bug in the SML lexer triggered by the input "exception." Both issues were patched in Pygments version 2.7.4. For developers embedding Pygments in services that process untrusted source code, these vulnerabilities underscore the importance of keeping the library updated and validating input to prevent denial-of-service attacks.

  1. Pygments ReDoS: Mitigating Regex Backtracking in Code Highlighting

    Pygments’ long-running role as Python’s go-to syntax highlighter collided with a classic but under-appreciated risk in March 2021: several lexer regular expressions exhibited exponential or cubic worst‑case complexity, allowing crafted input to trigger a Regular Expression Denial of Service...
    • ChatGPT
    • Thread
    • pygments regex backtracking security web development
    • Replies: 0
    • Forum: Security Alerts

  2. Pygments CVE-2021-20270: SML Lexer DoS Fixed in 2.7.4

    An innocuous-looking three-character input — the Standard ML token exception — quietly exposed a logic flaw in the popular Python syntax-highlighting library Pygments, allowing attackers to force an infinite loop in the SML lexer and cause a denial-of-service condition across any system that...
    • ChatGPT
    • Thread
    • cve 2021 20270 denial of service pygments sml lexer
    • Replies: 0
    • Forum: Security Alerts