CVE-2023-44270
First published: Fri Sep 29 2023(Updated: )
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be `\r` discrepancies, as demonstrated by `@font-face{ font:(\r/*);}` in a rule. This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/postcss | <8.4.31 | 8.4.31 |
| IBM Data Virtualization on Cloud Pak for Data | <=3.0 | |
| IBM Watson Query with Cloud Pak for Data | <=2.2 | |
| IBM Watson Query with Cloud Pak for Data | <=2.1 | |
| IBM Watson Query with Cloud Pak for Data | <=2.0 | |
| IBM Data Virtualization on Cloud Pak for Data | <=1.8 | |
| IBM Data Virtualization on Cloud Pak for Data | <=1.7 | |
| PostCSS Lab Function | <8.4.31 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2023-44270
- https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5
- https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25
- https://github.com/postcss/postcss/releases/tag/8.4.31
- https://github.com/github/advisory-database/issues/2820
- https://github.com/advisories/GHSA-7fh5-64p2-3v2j (Advisory)
- https://www.ibm.com/support/pages/node/7183851 (Advisory)
- https://access.redhat.com/errata/RHSA-2024:10517
- https://access.redhat.com/errata/RHSA-2024:10908
- https://access.redhat.com/errata/RHSA-2025:0654
- https://access.redhat.com/errata/RHSA-2025:0892
- https://access.redhat.com/errata/RHSA-2025:1824
- https://access.redhat.com/errata/RHSA-2025:1829
- https://access.redhat.com/errata/RHSA-2025:1865
- https://access.redhat.com/errata/RHSA-2025:1866
- https://bugzilla.redhat.com/show_bug.cgi?id=2326998
Frequently Asked Questions
What is the vulnerability identifier for this issue?
The vulnerability identifier for this issue is CVE-2023-44270.
What is the affected software?
The affected software is PostCSS before 8.4.31.
What is the impact of this vulnerability?
This vulnerability affects linters using PostCSS to parse external Cascading Style Sheets (CSS).
How can I fix this vulnerability?
To fix this vulnerability, upgrade PostCSS to version 8.4.31 or above.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the following references: [reference 1](https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25), [reference 2](https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5), [reference 3](https://github.com/postcss/postcss/releases/tag/8.4.31).
- collector/github-advisory-latest
- alias/GHSA-7fh5-64p2-3v2j
- alias/CVE-2023-44270
- collector/github-advisory
- agent/type
- agent/remedy
- agent/weakness
- agent/author
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/description
- agent/trending
- agent/source
- agent/severity
- agent/event
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/last-modified-date
- agent/references
- collector/nvd-cve
- collector/nvd-index
- collector/nvd-api
- agent/softwarecombine
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- package-manager/npm
- vendor/ibm
- canonical/ibm data virtualization on cloud pak for data
- version/ibm data virtualization on cloud pak for data/3.0
- canonical/ibm watson query with cloud pak for data
- version/ibm watson query with cloud pak for data/2.2
- version/ibm watson query with cloud pak for data/2.1
- version/ibm watson query with cloud pak for data/2.0
- version/ibm data virtualization on cloud pak for data/1.8
- version/ibm data virtualization on cloud pak for data/1.7
- vendor/postcss
- canonical/postcss lab function