Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

🗓️ 03 Sep 2025 21:32:23Reported by MicrosoftType 
mscve
 mscve🔗 msrc.microsoft.com👁 6 Views

PostCSS before 8.4.31 vulnerability: crafted CSS in linters can leak comment parts into output.

Related
ReporterTitlePublishedViews
Family
ibm
IBM Security Bulletins		Security Bulletin: IBM Storage Fusion may be vulnerable to Injection, Regular Expression Denial of Service (ReDoS), and Arbitrary Code Execution and via use of postcss, semver, babel-traverse (CVE-2023-45133, CVE-2022-25883, CVE-2023-44270)
16 Nov 202321:37
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM includes components with known vulnerabilities
12 Apr 202415:48
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities
14 Feb 202418:50
–ibm
ibm
IBM Security Bulletins		Security Bulletin: postcss-8.4.14.tgz is vulnerable to CVE-2023-44270 used in IBM Maximo Application Suite - Edge Data Collector
5 Mar 202409:13
–ibm
ibm
IBM Security Bulletins		Security Bulletin: Vulnerabilities in Eran Hammer cryptiles, PostCSS,Node.js,node-notifier,es5-ext ,MySQL Connectors,json-path and tough-cookie might affect IBM Storage Defender Copy Data Management
12 Dec 202515:25
–ibm
ibm
IBM Security Bulletins		Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities
3 May 202410:32
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in PostCSS
29 Nov 202314:47
–ibm
ibm
IBM Security Bulletins		Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for March 2024.
15 Apr 202502:17
–ibm
ibm
IBM Security Bulletins		Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to security restrictions bypass due to PostCSS CVE-2023-44270
5 Dec 202310:14
–ibm
ibm
IBM Security Bulletins		Security Bulletin: IBM Security QRadar Network Threat Analytics app for IBM QRadar SIEM includes components with known vulnerabilities
22 Jul 202515:48
–ibm
Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
03 Sep 2025 21:32Current
7High risk
Vulners AI Score7
CVSS 3.15.3
EPSS0.00822
SSVC
PostCSSvulnerabilitylintersuntrusted stylesheetcomment leakage
6