{"action":"Upgrade highlight.js to 9.18.1+dfsg1-3 or later.","affected":[{"fixed":"9.18.1+dfsg1-3","introduced":"0"}],"component":"highlight.js","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["9.18.1+dfsg1-3"],"id":"tcs_01M5NEX2JSW0SWH4CMH7S3FPFP","modified_at":"2026-09-11T11:02:31.203375091Z","published_at":"2020-11-24T23:15:11.223Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2020-26237","https://security-tracker.debian.org/tracker/CVE-2020-26237"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2020-26237#Debian:13/highlight.js","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2020-26237"}],"summary":"Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will r"}