Improper Input Validation

postcss is vulnerable to Improper Input Validation. The vulnerability is due to the RE_BAD_BRACKET in tokenize.js which does not account for carriage returns (\r). This means that any CSS containing a carriage return character \r would not be matched by this regular expression, potentially allowing malicious CSS to bypass any security or validation check that relies on this regular expression check. This can leads to potential CSS injection vulnerabilities.