CVE-2023-44270
Medium
Description
An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.
SeverityMedium
CVSS5.3
Exploit probability—
ProductPostcss
PublishedSep 29, 2023
First seenSep 29, 2023
How to fix
Update
- postcss postcss8.4.31 or later
- postcss8.4.31 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| postcss postcss | v < 8.4.31 | 8.4.31 |
| postcssnpm | v < 8.4.31 | 8.4.31 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.