PT-2023-7567

Name of the Vulnerable Software and Affected Versions PostCSS versions prior to 8.4.31 Description The issue affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contain parts parsed by PostCSS as a CSS comment. After processing by...

CVE-2023-44270

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the...

PostCSS Injection Vulnerability

Andrey Sitnik postcss is an application by the individual developer Andrey Sitnik in Spain. A tool for converting styles using JS plugins. An injection vulnerability exists in versions of PostCSS prior to 8.4.31. No information about this vulnerability is available at this time, please stay tuned...

CVE-2023-44270

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the...

Malicious Package

Overview postcss-file-match is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...

Malicious code in postcss-file-match (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 416239cd07c736ee9cda1661d413016b66a35ccd99054f13c8fb5b81fefa02dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-690 Malicious code in postcss-file-match (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 416239cd07c736ee9cda1661d413016b66a35ccd99054f13c8fb5b81fefa02dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview postcss-toc is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious code in postcss-fleexbugs-fixs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e1b9d652e96c357326a2bbdd94a69349443c42ed9a6d7115745a02db3e3cb47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5423 Malicious code in postcss-fleexbugs-fixs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e1b9d652e96c357326a2bbdd94a69349443c42ed9a6d7115745a02db3e3cb47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in postcss-lazy-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3af0b17a0cca4f52c02b138fec9e69ba2c506346ef1a6b57cbf893a03b7b5c46 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5424 Malicious code in postcss-lazy-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3af0b17a0cca4f52c02b138fec9e69ba2c506346ef1a6b57cbf893a03b7b5c46 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@100mslive/hms-video-react (>=0.3.27, <=0.3.125), @aagames-fe/google-translate (>=0.0.2, <=0.0.14) +544 more potentially affected by CVE-2021-23382 via postcss (>=8.0.0, <=8.2.12)

postcss NPM version =8.0.0, =0.3.27, =0.0.2, =1.1.0, =0.0.0-dev-4fb73016-20210914-1634176750976, =0.0.3, =0.5.4, =2.0.0-alpha.0, =2.8.0-canary.4, =2.7.5, =2.8.0-canary.5, =0.1101.0-next.0, =12.0.0-rc.0 - @arnosaine/react-scripts 4.0.3 - @astuteo/build-config 5.4.5 - @babytian/openinula-repl-next...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0x0.icu.anima (0.1.0) +9375 more potentially affected by CVE-2021-23382 via postcss (>=7.0.0, <=7.0.35)

postcss NPM version =7.0.0, =1.0.1, =1.0.1, =0.1.0, =0.1.2, =0.1.0, =0.1.0, =0.1.1, =1.0.0, =3.4.2 and more Source cves: CVE-2021-23382 Source advisory: OSV:GHSA-566M-QJ78-RWW5...

GHSA-566M-QJ78-RWW5 Regular Expression Denial of Service in postcss

The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service ReDoS via getAnnotationURL and loadAnnotation in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern regex /\s sourceMappingURL=. PoC js var...

Regular Expression Denial of Service in postcss

The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service ReDoS via getAnnotationURL and loadAnnotation in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern regex /\s sourceMappingURL=. PoC js var...

The vulnerability of the PostCSS library in Aurora Application Software, related to uncontrolled resource consumption, allows attackers to cause service failures.

The vulnerability of the PostCSS application library in Aurora Software Center, related to uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Regular Expression Denial of Service

Overview postcss from 7.0.0 and before version 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service ReDoS during source map parsing. Recommendation Upgrade to version 8.2.10 or later References - CVE - GitHub Advisory...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0x0.icu.anima (0.1.0) +9375 more potentially affected by CVE-2021-23368 via postcss (>=7.0.0, <=7.0.35)

postcss NPM version =7.0.0, =1.0.1, =1.0.1, =0.1.0, =0.1.2, =0.1.0, =0.1.0, =0.1.1, =1.0.0, =3.4.2 and more Source cves: CVE-2021-23368 Source advisory: OSV:GHSA-HWJ9-H5MP-3PM3...

Regular Expression Denial of Service in postcss

The npm package postcss from 7.0.0 and before versions 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service ReDoS during source map parsing...