« Volver al listado

CVE-2025-45526

Estado: AplazadaBaja (2.9)—

A denial of service (DoS) vulnerability has been identified in the JavaScript library microlight version 0.0.7. This library, used for syntax highlighting, does not limit the size of textual content it processes in HTML elements with the microlight class. When excessively large content (e.g., 100 million characters) is processed, the reset function in microlight.js consumes excessive memory and CPU resources, causing browser crashes or unresponsiveness.

Leer descripción completaMostrar menos

An attacker can exploit this vulnerability by tricking a user into visiting a malicious web page containing a microlight element with large content, resulting in a denial of service. NOTE: this is disputed by multiple parties because a large amount of memory and CPU resources is expected to be needed for content of that size.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Microlight — MicrolightAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-45526",
  "cveTags": [
    {
      "tags": [
        "disputed"
      ],
      "sourceIdentifier": "cve@mitre.org"
    }
  ],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-45526",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-26T16:10:14.187631Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 2.9,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.4
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "asvd",
          "product": "microlight",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "0.0.7"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-06-17T20:15:32.243",
  "references": [
    {
      "url": "https://gist.github.com/Rootingg/483b09b760d031b62b172f2153f3ed2a",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/github/advisory-database/pull/5730",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://gist.github.com/Rootingg/483b09b760d031b62b172f2153f3ed2a",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A denial of service (DoS) vulnerability has been identified in the JavaScript library microlight version 0.0.7. This library, used for syntax highlighting, does not limit the size of textual content it processes in HTML elements with the microlight class. When excessively large content (e.g., 100 million characters) is processed, the reset function in microlight.js consumes excessive memory and CPU resources, causing browser crashes or unresponsiveness. An attacker can exploit this vulnerability by tricking a user into visiting a malicious web page containing a microlight element with large content, resulting in a denial of service. NOTE: this is disputed by multiple parties because a large amount of memory and CPU resources is expected to be needed for content of that size."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad de denegación de servicio (DoS) en la librería de JavaScript microlight versión 0.0.7. Esta librería, utilizada para el resaltado de sintaxis, no limita el tamaño del contenido textual que procesa en elementos HTML con la clase microlight. Cuando se procesa contenido excesivamente grande (p. ej., 100 millones de caracteres), la función de reinicio de microlight.js consume una cantidad excesiva de memoria y recursos de CPU, lo que provoca bloqueos o incapacidad de respuesta del navegador. Un atacante puede explotar esta vulnerabilidad engañando al usuario para que visite una página web maliciosa que contenga un elemento microlight con contenido extenso, lo que resulta en una denegación de servicio."
    }
  ],
  "lastModified": "2026-06-17T09:25:34.370",
  "sourceIdentifier": "cve@mitre.org"
}