CVE-2020-27511: Prototypejs Prototype

High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days.

An issue was discovered in the stripTags and unescapeHTML components in Prototype 1.7.3 where an attacker can cause a Regular Expression Denial of Service (ReDOS) through stripping crafted HTML tags.

Affected products

• Prototypejs Prototype: version 1.7.3 only

Published 2021-06-21. Last modified 2026-06-17.