Packages / postcss / Security

ModerateVulnerabilityGHSA-7fh5-64p2-3v2jCVE-2023-44270Published 30 Sep 2023

PostCSS line return parsing error

Affected releases · postcss

  • 8.x8.0.0 – 8.4.30Fixed in 8.4.31
  • 7.x and older0.1.0 – 7.0.39No fix, no longer updated

On 8.x, the newest line:

npm install postcss@8.4.31
8.x

  1. Affected

    8.0.0 – 8.4.30

    84 releases

  2. Fixed

    8.4.31 – 8.5.31

    51 releases, latest

7.x

  1. Affected

    7.0.0 – 7.0.39

    40 releases

6.x

  1. Affected

    6.0.0 – 6.0.23

    24 releases

5.x

  1. Affected

    5.0.0 – 5.2.18

    44 releases

4.x

  1. Affected

    4.0.0 – 4.1.16

    24 releases

3.x

  1. Affected

    3.0.0 – 3.0.7

    8 releases

2.x

  1. Affected

    2.0.0 – 2.2.6

    11 releases

1.x

  1. Affected

    1.0.0 – 1.1.0

    2 releases

0.x

  1. Affected

    0.1.0 – 0.3.5

    8 releases

296 stable releases of postcss, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for postcss. It is read in your browser and sent nowhere.

What happens

An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.

This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.