CVE-2023-44270 (Medium) detected in postcss-8.4.12.tgz

[mend-for-github-com]

CVE-2023-44270 - Medium Severity Vulnerability

Vulnerable Library - postcss-8.4.12.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.12.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/postcss/package.json,/node_modules/postcss/package.json

Dependency Hierarchy:

• ❌ postcss-8.4.12.tgz (Vulnerable Library)

Found in HEAD commit: cba076465f44b6a819e3cff7986ff4cd21a66371

Found in base branch: main

Vulnerability Details

An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.

Publish Date: 2023-09-29

URL: CVE-2023-44270

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-44270

Release Date: 2023-09-29

Fix Resolution: postcss - 8.4.31

---

• Check this box to open an automated fix PR

[AMoo-Miki]

We cannot move past postcss@8.4.21 because that is their last version that uses typescript@4.

[AMoo-Miki]

We might have to backport postcss/postcss@58cc860 to postcss@8.4.21 and make a custom release of it.