GHSA-P28H-CC7Q-C4FG css-what vulnerable to ReDoS due to use of insecure regular expression

The package css-what before 2.1.3 is vulnerable to Regular Expression Denial of Service ReDoS due to the use of insecure regular expression in the reattr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function...

@libero/texture (>=0.0.1, <=0.0.15), angular-substance (>=1.0.0-2, <=1.0.0-7) +17 more potentially affected by CVE-2022-21222 via css-what (>=2.0.2, <=2.1.0)

css-what NPM version =2.0.2, =0.0.1, =1.0.0-2, =2.0.0-alpha.1, =0.5.0, =0.0.3-3, =0.1.0, =0.0.1-Alpha, =0.25.0-preview.0, =0.1.0, =0.27.0, =0.27.0, =0.1.0, =0.141.0, =2.0.0-preview.19 and more Source cves: CVE-2022-21222 Source advisory: OSV:GHSA-P28H-CC7Q-C4FG...

@libero/texture (>=0.0.1, <=0.0.15), angular-substance (>=1.0.0-2, <=1.0.0-7) +17 more potentially affected by CVE-2022-21222 via css-what (>=2.0.2, <=2.1.0)

css-what NPM version =2.0.2, =0.0.1, =1.0.0-2, =2.0.0-alpha.1, =0.5.0, =0.0.3-3, =0.1.0, =0.0.1-Alpha, =0.25.0-preview.0, =0.1.0, =0.27.0, =0.27.0, =0.1.0, =0.141.0, =2.0.0-preview.19 and more Source cves: CVE-2022-21222 Source advisory: GHSA-P28H-CC7Q-C4FG...

CVE-2022-21222

A vulnerability was found in the css-what package. The flaw allows Regular expression denial of service ReDoS attacks, affecting system availability...

DEBIAN-CVE-2022-21222

The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service ReDoS due to the usage of insecure regular expression in the reattr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function...

UBUNTU-CVE-2022-21222

The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service ReDoS due to the usage of insecure regular expression in the reattr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function...

CVE-2022-21222

The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service ReDoS due to the usage of insecure regular expression in the reattr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function...

CVE-2022-21222

CVE-2022-21222 affects the Node.js package css-what prior to version 2.1.3. The vulnerability stems from an insecure regular expression in the re_attr variable of index.js, enabling Regular Expression Denial of Service (ReDoS) via the parse function. Affected users should upgrade to 2.1.3 or newe...

08cms (1.0.0), 1pif-to-keepass (0.1.0) +6772 more potentially affected by CVE-2022-21222 via css-what (>=1.0.0, <=2.1.0)

css-what NPM version =1.0.0, =0.0.1, =0.11.3-alpha.1660, =0.1.0, =0.0.1, =0.0.0, =1.0.0, =1.0.1, =0.0.1, =2.0.0, =2.2.0 - @battlemidget/generator-nm 1.4.1 and more Source cves: CVE-2022-21222 Source advisory: MEND:CVE-2022-21222...

CVE-2022-21222 Regular Expression Denial of Service (ReDoS)

The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service ReDoS due to the usage of insecure regular expression in the reattr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function...

CVE-2022-21222 Regular Expression Denial of Service (ReDoS)

The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service ReDoS due to the usage of insecure regular expression in the reattr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function...

CVE-2022-21222 Regular Expression Denial of Service (ReDoS)

The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service ReDoS due to the usage of insecure regular expression in the reattr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function...

CVE-2022-21222

The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service ReDoS due to the usage of insecure regular expression in the reattr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function...

Drawing a star with DOMMatrix

I recently recorded an episode of HTTP 203 on DOMPoint and DOMMatrix. If you'd rather watch the video version, here it is, but come back here for some bonus details on a silly mistake I made, which I almost got away with. DOMMatrix lets you apply transformations to DOMPoints. I find these APIs...

CSS-What resource management error vulnerability

css-what is a CSS selector parser. A resource management error vulnerability exists in versions of css-what prior to 2.1.3, which stems from the use of an unsafe regular expression in the reattr variable of index.js...

CVE-2022-21222

The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service ReDoS due to the usage of insecure regular expression in the reattr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function...

PT-2022-14933 · Css-What +2 · Css-What +2

Name of the Vulnerable Software and Affected Versions: css-what versions prior to 2.1.3 Description: The issue is related to a Regular Expression Denial of Service ReDoS due to the usage of an insecure regular expression in the re attr variable of index.js. This could be triggered via the parse...

Debian DSA-5244-1 : chromium - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5244 advisory. - Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinced a user to install...

CVE-2022-21222: Inefficient Regular Expression Complexity

The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service ReDoS due to the usage of insecure regular expression in the reattr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function...

Google Chrome CSS Memory Misreference Vulnerability

Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in versions of Google Chrome prior to 106.0.5249.62, which stems from a mix-up of instructions responsible for freeing memory in CSS. An attacker can exploit the vulnerability to cause a...