CVE-2023-48631: @adobe/css-tools Improper Input Validation and Inefficient Regular Expression Complexity

December 14, 2023 (updated December 18, 2023)

Impact

@adobe/css-tools version 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.

Patches

The issue has been resolved in 4.3.2.

Workarounds

None

References

N/A

References

github.com/adobe/css-tools/commit/472bef91bde9caab305f3f36231ad0c253581b43
github.com/adobe/css-tools/issues/211
github.com/adobe/css-tools/pull/249
github.com/adobe/css-tools/security/advisories/GHSA-prr3-c3m5-p7q2
github.com/advisories/GHSA-prr3-c3m5-p7q2

Code Behaviors & Features

Detect and mitigate CVE-2023-48631 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →