technology software

entertainment media

e-commerce shopping

documentation technical

news media journalism

English

sessionid

steamCountry

Domain 'partner.steamgames.com' uses the commercial generic top-level domain (.com) with subdomain 'partner'. The core label 'steamgames' covers 10 characters containing 4 vowels alongside six consonants. It segments into two words: steam, games. Median word length is five characters. No strong language cues emerged from the frequency lists.

language

html/f1/b3/f1b3d420-3b57-4bc5-8130-ce0eac1ab09a.html.gz

default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none'; connect-src 'self' https://steamcommunity.com/ https://help.steampowered.com/ https://store.steampowered.com/ https://steamstats.valve.org/ https://api.steampowered.com/ https://login.steampowered.com/; frame-src 'self' https://store.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com; report-uri /actions/CSPReport

39cbe8d0785370b4ebda08f844727ac3a6fc5cab10bd26cbeda5dc36ff4166d0

187934abf67c5e39b0ac2af4b62ebafe1f65ef3d134ea452bf5f1cebc75b211d

87545ee670a3687601346811d0512cfa9e3012406b6537dd2f1038ceaa381a29

61a576a3320ca472662a8c9de3d2ebd69f629c30aaa63407e52143f39e66ba34

649079faa53bdee5b55587592a81221ba7a9db9af1712481e54f6519656d3e5e

cdd6526af0278055105dec19997395778cb5312df379dedd0e3c6ae11aedc6f2

75217343f6ac3e65c340a68cfc2c911b24c1e1ef4a14084558e158bd5b0c4b86

7d58d9333ebf5153f1b3c12e4548af608648fcd9352d19534d1b3e6268d2d2ff

96cb0deb6519ae36b03be418a20a8a8241a60e8d0ac41ce65494ca992e3aaff1

09add7eb5596e05440a163225763ed290dc2c02eae9bda24edf44d707817a5b7

f28b2dcafa192afed5867ec5a56ff90db7c59fc03ae5ab825ce33ece67a4fa5d

9adb337d8ed69b43f0c1041304070cf246d4f278f89fe60b55f828ae273a97c4

272dc14aadc2c8d974a90cd8fff5117a2c62a955d104995599b5677916c3efc0

### Impact

Affected versions of this package are vulnerable to Prototype Pollution.  A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting.  If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. 

The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector. 

_If your website or application does not render user provided data it should be unaffected._

### Patches

Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability.  If you are using version 7 or 8 you are encouraged to upgrade to a newer release.

### Workarounds

#### Patch your library

Manually patch your library to create null objects for both `languages` and `aliases`:

```js
const HLJS = function(hljs) {
  // ...
  var languages = Object.create(null);
  var aliases = Object.create(null);
```

#### Filter out bad data from end users:

Filter the language names that users are allowed to inject into your HTML to guarantee they are valid.

### References

* [What is Prototype Pollution?](https://codeburst.io/what-is-prototype-pollution-49482fc4b638)
* https://github.com/highlightjs/highlight.js/pull/2636

### For more information

If you have any questions or comments about this advisory:

* Please file an issue against [highlight.js](https://github.com/highlightjs/highlight.js/issues/)

### Impact: Potential ReDOS vulnerabilities (exponential and polynomial RegEx backtracking)

[oswasp](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS): 

> The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.

If are you are using Highlight.js to highlight user-provided data you are possibly vulnerable.  On the client-side (in a browser or Electron environment) risks could include lengthy freezes or crashes... On the server-side infinite freezes could occur... effectively preventing users from accessing your app or service (ie, Denial of Service).

This is an issue with grammars shipped with the parser (and potentially 3rd party grammars also), not the parser itself. If you are using Highlight.js with any of the following grammars you are vulnerable.  If you are using `highlightAuto` to detect the language (and have any of these grammars registered) you are vulnerable. Exponential grammars (C, Perl, JavaScript) are auto-registered when using the common grammar subset/library `require('highlight.js/lib/common')` as of 10.4.0 - see https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@10.4.0/build/highlight.js

All versions prior to 10.4.1 are vulnerable, including version 9.18.5. 

**Grammars with exponential backtracking issues:**

  - c-like (c, cpp, arduino)
  - handlebars (htmlbars)
  - gams
  - perl
  - jboss-cli
  - r
  - erlang-repl
  - powershell
  - routeros
  - livescript (10.4.0 and 9.18.5 included this fix)
  - javascript & typescript (10.4.0 included partial fixes)

And of course any aliases of those languages have the same issue. ie: `hpp` is no safer than `cpp`.

**Grammars with polynomial backtracking issues:**

- kotlin
- gcode
- d
- aspectj
- moonscript
- coffeescript/livescript
- csharp
- scilab
- crystal
- elixir
- basic
- ebnf
- ruby
- fortran/irpf90
- livecodeserver
- yaml
- x86asm
- dsconfig
- markdown
- ruleslanguage
- xquery
- sqf

And again: any aliases of those languages have the same issue. ie: `ruby` and `rb` share the same ruby issues.


### Patches

- Version 10.4.1 resolves these vulnerabilities.  Please upgrade.

### Workarounds / Mitigations

- Discontinue use the affected grammars. (or perhaps use only those with poly vs exponential issues)
- Attempt cherry-picking the grammar fixes into older versions...
- Attempt using newer CDN versions of any affected languages.  (ie using an older CDN version of the library with newer CDN grammars).  Your mileage may vary.

### References

- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

### For more information

If you have any questions or comments about this advisory:
* Open an issue: https://github.com/highlightjs/highlight.js/issues
* Email us at [security@highlightjs.com](mailto:security@highlightjs.com)

61c71b0ebf72ea0d8fc27d307870302ea163aa9bd344b3ba1402a2e894721925

00e6a7813ab8f3a8e12d7b0d0af5d0d77915bdcee003f741414aecde99cc0b8b

bef089c96101aef9fb6c19c82d3920dda79285cff1392448769748d2243182f4

39a1738d5d4aa1a9e22a379fcdd7f4af8e34c7bbf97a2e8c92f4177deb62b570

028e7fc83a924caac52d4abad7d5ecc8cc44376b73c17be8107f8b96cfb36075

e8822f532ae9349b2b5743c494efd216ed4e44f9ebc82a6b1cb54895a5b88433

viewport

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

html/f1/b3/f1b3d420-3b57-4bc5-8130-ce0eac1ab09a_nodriver.html.gz

Steam Spring Sale 2026 (Steamworks Documentation)

MarkMonitor Inc.

STEAMGAMES.COM

NOC United States

ipadmin

Akamai Technologies, Inc.

Steven Jay Schecter

AKAMAI

Object.seal && [ Object, Array, String, Number ].map( function( builtin ) { Object.seal( builtin.prototype ); } );

$J = jQuery.noConflict();$ = $J;
			document.addEventListener('DOMContentLoaded', function(event) {
				SetupTooltips( { tooltipCSSClass: 'jsTooltip'} );
			});


		$J( document ).ready( function() {
			appendRenderedSectionsToNavTree();
			bindCollapseToggles();
			updateSelectedSection();
			HideDocMenuOnMobile();

			window.addEventListener("hashchange", updateSelectedSection );
		} );
	


	$J( InitMiniprofileHovers( 'https%3A%2F%2Fpartner.steamgames.com' ) );
    	g_sessionID = "266517a6004007897cb0bca2";



	g_sessionID = "266517a6004007897cb0bca2";
	g_rgAllAffiliatedPublishers = [];
	g_nPrimaryPublisher = 0;

	function GoToEditPage( page, id )
	{
		if ( checkNumeric( id ) )
		{
			window.location.href = "https://partner.steamgames.com/apps/" + page + "/" + id;
		}
	}

	function checkNumeric( value )
	{
		var anum=/(^\d+$)|(^\d+\.\d+$)/
		if (anum.test(value))
			return true;
		return false;
	}


JQuery

✅ Low Risk - https://partner.steamgames.com/doc/marketing/upcoming_events/2026_spring_sale

Requests	IP Address	Location	AS Autonomous System
19	23.197.130.99	Frankfurt am Main, Hesse, Germany	AS16625Akamai Technologies, Inc.
17	184.24.77.156	Germany	AS20940
17	184.25.50.26	Germany	AS16625
53	3	-	-

Security Scan Report: partner.steamgames.com

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies1

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History