~ / search / GHSA-p28h-cc7q-c4fg

GHSA-p28h-cc7q-c4fg

css-what vulnerable to ReDoS due to use of insecure regular expression

Source: GitHub Advisory Database (reviewed) High CVE-2022-21222

Packages

EcosystemPackageAffectedFixed in
npm css-what < 2.1.3 2.1.3

Details

As written in the advisory (Markdown source, shown as plain text).

The package css-what before 2.1.3 is vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of insecure regular expression in the `re_attr` variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.

References

External links from the advisory. They lead to third-party sites.