Postcss
Monthly
A crafted flat CSS selector can stall a synchronous parser thread in postcss-selector-parser versions prior to 7.1.6, because class and ID index lists are scanned repeatedly inside parsing passes that should be linear, producing quadratic (O(n^2)) parse cost. Only consumers that synchronously parse untrusted selector strings on an exposed request path are affected; the vendor explicitly notes ordinary build-time parsing of trusted sources is not affected. The issue is remotely triggerable by unauthenticated attackers where that precondition holds (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.9), is availability-only with no confidentiality or integrity impact, and there is no public exploit code and no confirmed active exploitation (no KEV listing) at time of analysis. A vendor-released patch, version 7.1.6, is available.
Path traversal in PostCSS npm package (versions through 8.5.22) allows disclosure of arbitrary `.map` files from the server filesystem when applications process attacker-controlled CSS without the `from` option. The vulnerability is an incomplete fix bypass of prior advisory GHSA-6g55-p6wh-862q: the traversal guard added to `PreviousMap.loadFile()` was gated on `cssFile` being truthy, which is never the case when `opts.from` is absent. No CISA KEV listing, but a verified proof-of-concept is included in the upstream GHSA advisory GHSA-fxqj-rqcc-2cmp. The CVSS 4.0 score of 6.3 with AT:P correctly reflects the specific deployment condition required.
Uncontrolled recursion in PostCSS up to 7.1.1 allows remote attackers to trigger denial of service via crafted CSS input requiring user interaction. The vulnerability resides in the toString function of AST serialization logic (src/selectors/container.js). Publicly available exploit code exists (EPSS exploitation probability should be assessed). Vendor considers this low-risk since most users compile their own CSS rather than processing untrusted user-generated CSS, indicating limited real-world attack surface in typical deployment scenarios.
PostCSS versions prior to 8.5.10 fail to escape `</style>` sequences when stringifying CSS Abstract Syntax Trees, allowing cross-site scripting (XSS) attacks when user-submitted CSS is embedded in HTML `<style>` tags. An attacker can inject CSS containing `</style>` sequences in property values to break out of the style context and execute arbitrary JavaScript in the victim's browser. This requires user interaction (UI:R) and affects applications that parse untrusted CSS and re-stringify it for embedding in HTML documents.
An issue was discovered in PostCSS before 8.4.31. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A crafted flat CSS selector can stall a synchronous parser thread in postcss-selector-parser versions prior to 7.1.6, because class and ID index lists are scanned repeatedly inside parsing passes that should be linear, producing quadratic (O(n^2)) parse cost. Only consumers that synchronously parse untrusted selector strings on an exposed request path are affected; the vendor explicitly notes ordinary build-time parsing of trusted sources is not affected. The issue is remotely triggerable by unauthenticated attackers where that precondition holds (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.9), is availability-only with no confidentiality or integrity impact, and there is no public exploit code and no confirmed active exploitation (no KEV listing) at time of analysis. A vendor-released patch, version 7.1.6, is available.
Path traversal in PostCSS npm package (versions through 8.5.22) allows disclosure of arbitrary `.map` files from the server filesystem when applications process attacker-controlled CSS without the `from` option. The vulnerability is an incomplete fix bypass of prior advisory GHSA-6g55-p6wh-862q: the traversal guard added to `PreviousMap.loadFile()` was gated on `cssFile` being truthy, which is never the case when `opts.from` is absent. No CISA KEV listing, but a verified proof-of-concept is included in the upstream GHSA advisory GHSA-fxqj-rqcc-2cmp. The CVSS 4.0 score of 6.3 with AT:P correctly reflects the specific deployment condition required.
Uncontrolled recursion in PostCSS up to 7.1.1 allows remote attackers to trigger denial of service via crafted CSS input requiring user interaction. The vulnerability resides in the toString function of AST serialization logic (src/selectors/container.js). Publicly available exploit code exists (EPSS exploitation probability should be assessed). Vendor considers this low-risk since most users compile their own CSS rather than processing untrusted user-generated CSS, indicating limited real-world attack surface in typical deployment scenarios.
PostCSS versions prior to 8.5.10 fail to escape `</style>` sequences when stringifying CSS Abstract Syntax Trees, allowing cross-site scripting (XSS) attacks when user-submitted CSS is embedded in HTML `<style>` tags. An attacker can inject CSS containing `</style>` sequences in property values to break out of the style context and execute arbitrary JavaScript in the victim's browser. This requires user interaction (UI:R) and affects applications that parse untrusted CSS and re-stringify it for embedding in HTML documents.
An issue was discovered in PostCSS before 8.4.31. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.