CVE-2023-44270
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be `\r` discrepancies, as demonstrated by `@font-face{ font:(\r/*);}` in a rule. This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability identifier for this issue?
The vulnerability identifier for this issue is CVE-2023-44270.
What is the affected software?
The affected software is PostCSS before 8.4.31.
What is the impact of this vulnerability?
This vulnerability affects linters using PostCSS to parse external Cascading Style Sheets (CSS).
How can I fix this vulnerability?
To fix this vulnerability, upgrade PostCSS to version 8.4.31 or above.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the following references: [reference 1](https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25), [reference 2](https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5), [reference 3](https://github.com/postcss/postcss/releases/tag/8.4.31).