MAL-2026-17482 Malicious code in css-logical-prop-shim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0ffba65f80ee8f200199c8c90ebb6297b8590537c80ea50bb34874d91665b5f The package ships thunderboltRegistry.js which imports childprocess and invokes execSync with curl commands at multiple sites lines 30, 39, 47, 48. T...

MAL-2026-17478 Malicious code in css-field-sizing-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 549bb8820cb6a8a35853826d17b64df14c0561b83790192a33c5dc76dbad53b9 The package advertises itself as a CSS field-sizing polyfill but ships thunderboltRegistry.js, which runs an IIFE at module load time. The IIFE shell...

Malicious code in css-field-sizing-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 549bb8820cb6a8a35853826d17b64df14c0561b83790192a33c5dc76dbad53b9 The package advertises itself as a CSS field-sizing polyfill but ships thunderboltRegistry.js, which runs an IIFE at module load time. The IIFE shell...

MAL-2026-17477 Malicious code in css-env-function-shim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03e6fced50259d6d3781ef3917caba965e4744420188c3e06919541b64e2e294 Package self-describes as a CSS env shim but ships thunderboltRegistry.js, which runs an IIFE at module load that base64-decodes the strings...

Malicious code in css-env-function-shim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03e6fced50259d6d3781ef3917caba965e4744420188c3e06919541b64e2e294 Package self-describes as a CSS env shim but ships thunderboltRegistry.js, which runs an IIFE at module load that base64-decodes the strings...

MAL-2026-17479 Malicious code in css-gap-decorations-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8126656cc344a4f632b8ddf5a23683fc92ac22798bb67e1aed6bca73ac82d7b6 The package is published as a CSS polyfill but ships no polyfill functionality. On require, thunderboltRegistry.js uses childprocess.execSync to run...

Malicious code in css-gap-decorations-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8126656cc344a4f632b8ddf5a23683fc92ac22798bb67e1aed6bca73ac82d7b6 The package is published as a CSS polyfill but ships no polyfill functionality. On require, thunderboltRegistry.js uses childprocess.execSync to run...

Malicious code in css-anchor-pos-fallback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd0a6c8e1448ffd9abb3732872ea3d49280a422d49524aaa57d0b89a73812f05 The package advertises itself as a CSS anchor-position polyfill but on require executes an IIFE in thunderboltRegistry.js that runs id, whoami, uname...

MAL-2026-17476 Malicious code in css-anchor-pos-fallback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd0a6c8e1448ffd9abb3732872ea3d49280a422d49524aaa57d0b89a73812f05 The package advertises itself as a CSS anchor-position polyfill but on require executes an IIFE in thunderboltRegistry.js that runs id, whoami, uname...

Malicious code in css-a11y-contrast-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85ad65ab7d49c4277898f5da5b5d45f3ec9cde46035bcf6416e3a95507ca1301 [email protected] is advertised as a WCAG contrast utility but ships no contrast code — index.js exports an empty object. The package...

MAL-2026-17475 Malicious code in css-a11y-contrast-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85ad65ab7d49c4277898f5da5b5d45f3ec9cde46035bcf6416e3a95507ca1301 [email protected] is advertised as a WCAG contrast utility but ships no contrast code — index.js exports an empty object. The package...

CVE-2026-104844

A flaw was found in postcss-selector-parser. A remote attacker could exploit this vulnerability by submitting a specially crafted CSS selector containing numerous class or ID identifiers to an application that parses untrusted input. Due to inefficient processing and repeated scanning during...

CVE-2026-1661

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

CVE-2026-1661

The WP Mail Logging WordPress plugin, in versions prior to 1.17.0 , is vulnerable to HTML injection because it fails to properly restrict the HTML and CSS of logged emails before rendering them in admin log screens. This allows unauthenticated users to inject styled content and links—for instance...

PT-2026-104103

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

CVE-2026-1661: Improper Neutralization of Input During Web Page Generation

The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an...

PYSEC-2026-4170 Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

Summary soupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared IDENTIFIER sub-pattern also embedded in VALUE, and therefore in attribute selectors places two adjacent quantified groups over overlapping character classes: ?:classA|ESC+?:classB|ESC, where...

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

Summarysoupsieve compiles CSS selector strings with a set of hand-written regular expressions. The shared IDENTIFIER sub-pattern also embedded in VALUE, and therefore in attribute selectors places two adjacent quantified groups over overlapping character classes: ?:classA|ESC+?:classB|ESC, where...

PYSEC-2026-4171 Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

Summary Before tokenizing, selectoriter trims leading/trailing whitespace and comments by running two regexes over the whole raw selector with .search. The trailing one, REWSEND = re.compiler'WSC$', is anchored only at the end $, not the start. Because .search retries the pattern at every offset,...

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

SummaryBefore tokenizing, selectoriter trims leading/trailing whitespace and comments by running two regexes over the whole raw selector with .search. The trailing one, REWSEND = re.compiler'WSC$', is anchored only at the end $, not the start. Because .search retries the pattern at every offset, ...