PostCSS line return parsing error
Published 30 Sept 2023 · Updated 10 Sept 2026
Affected package
- Affected
- <8.4.31
- Fixed in
- 8.4.31
npm install postcss@8.4.31Details
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
Is GHSA-7fh5-64p2-3v2j in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected postcss, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-44270
- Linkgithub.com/github/advisory-database/issues/2820
- Linkgithub.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5
- Packagegithub.com/postcss/postcss
- Linkgithub.com/postcss/postcss/blob/main/lib/tokenize.js#L25
- Linkgithub.com/postcss/postcss/releases/tag/8.4.31
- Linklists.debian.org/debian-lts-announce/2024/12/msg00025.html
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.