CVE-2021-20270: 
Python vulnerability analysis and mitigation

CVE-2021-20270 affects Pygments versions 1.5 to 2.7.3, where an infinite loop vulnerability exists in the SMLLexer component. The vulnerability was discovered in December 2020 and publicly disclosed in March 2021. The issue affects systems using Pygments for syntax highlighting of Standard ML (SML) source files (NVD, CVE).

The vulnerability occurs in the SMLLexer component when processing Standard ML source files. Specifically, the infinite loop is triggered when the lexer encounters input that contains only the "exception" keyword. The SMLLexer component was introduced in Pygments version 1.5, making versions prior to this unaffected (Red Hat Bugzilla).

When successfully exploited, this vulnerability can lead to a denial of service condition when performing syntax highlighting operations. The impact is primarily on system availability, as the infinite loop consumes system resources (NVD).

The vulnerability has been fixed in versions after 2.7.3. Users should upgrade to a patched version of Pygments. The fix was implemented in an upstream patch that addresses the infinite loop condition in the SMLLexer component (Red Hat Bugzilla).