HighGHSA-p28h-cc7q-c4fgCVE-2022-21222
css-what vulnerable to ReDoS due to use of insecure regular expression
Published 1 Oct 2022 · Updated 20 May 2025
Affected package
css-whatnpm
- Affected
- <2.1.3
- Fixed in
- 2.1.3
Update to the fixed version for your release line, for example:
npm install css-what@2.1.3Details
The package css-what before 2.1.3 is vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.
Is GHSA-p28h-cc7q-c4fg in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected css-what, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2022-21222
- Linkgithub.com/fb55/css-what/commit/dc510929790da6617e7aa93a616498b22f6a6b72
- Packagegithub.com/fb55/css-what
- Linkgithub.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.js#23L12
- Linkgithub.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.js%23L12
- Linklists.debian.org/debian-lts-announce/2023/03/msg00001.html
- Linksecurity.snyk.io/vuln/SNYK-JS-CSSWHAT-3035488
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.