You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
postcss is a PostCSS is a tool for transforming styles with JS plugins.
Affected versions of this package are vulnerable to Improper Input Validation when parsing external Cascading Style Sheets (CSS) with linters using PostCSS. An attacker can cause discrepancies by injecting malicious CSS rules, such as @font-face{ font:(\r/*);}.
This vulnerability is because of an insecure regular expression usage in the RE_BAD_BRACKET variable.
Overview
postcss is a PostCSS is a tool for transforming styles with JS plugins.
Affected versions of this package are vulnerable to Improper Input Validation when parsing external Cascading Style Sheets (CSS) with linters using PostCSS. An attacker can cause discrepancies by injecting malicious CSS rules, such as
@font-face{ font:(\r/*);}
.This vulnerability is because of an insecure regular expression usage in the
RE_BAD_BRACKET
variable.Remediation
Upgrade
postcss
to version 8.4.31 or higher.References
The text was updated successfully, but these errors were encountered: