GitHub Advisoryadvisory · npm

GHSA-7fh5-64p2-3v2j PostCSS line return parsing error

MEDIUM Published 2023-09-30 Modified 2025-11-04 Official page ↗
Aliases
CVE-2023-44270
Ecosystem
npm
Packages
postcss
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-144, CWE-74
Reviewed
2023-10-03

Affected packages

• npm postcss: < 8.4.31 → fixed in 8.4.31

Description

An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be `\r` discrepancies, as demonstrated by `@font-face{ font:(\r/*);}` in a rule. This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.

Related

Alias · CVE (1)

  • CVE-2023-44270 An issue was discovered in PostCSS before 8.4.31. vulnerability

Weakness · CWE (2)

  • CWE-144 Improper Neutralization of Line Delimiters weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References