A null pointer dereference vulnerability was discovered in microlight.js (version 0.0.7), a lightweight syntax highlighting library. When processing elements with non-standard CSS color values, the library fails to validate result of regular expression match before accessing its properties, leading an uncaught TypeError and potential application crash.