CVE-2023-44270: PostCSS line return parsing error
(updated )
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
References
- github.com/advisories/GHSA-7fh5-64p2-3v2j
- github.com/github/advisory-database/issues/2820
- github.com/postcss/postcss
- github.com/postcss/postcss/blob/main/lib/tokenize.js
- github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5
- github.com/postcss/postcss/releases/tag/8.4.31
- lists.debian.org/debian-lts-announce/2024/12/msg00025.html
- nvd.nist.gov/vuln/detail/CVE-2023-44270
Code Behaviors & Features
Detect and mitigate CVE-2023-44270 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →