CVE-2020-27511: 
NixOS vulnerability analysis and mitigation

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in the stripTags and unescapeHTML components of Prototype 1.7.3. The vulnerability, identified as CVE-2020-27511, allows an attacker to cause a denial of service through stripping crafted HTML tags (NVD, PoC).

The vulnerability exists in the string processing functions of Prototype 1.7.3, specifically in the stripTags and unescapeHTML components. It has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The CVSS v2.0 base score is 5.0 (MEDIUM) with vector (AV:N/AC:L/Au:N/C:N/I:N/A:P) (NVD).

When exploited, this vulnerability can lead to a Regular Expression Denial of Service (ReDOS) condition, potentially causing the affected application to become unresponsive. The impact is primarily on the availability of the service, with no direct effect on confidentiality or integrity (NVD).

Users should upgrade to a patched version of Prototype if available. The vulnerability affects version 1.7.3 of the Prototype JavaScript framework (Vendor Advisory).