Code Injection Vulnerability in PostCSS Affects CSS Parsing

CVE-2023-44270

What is CVE-2023-44270?

A code injection vulnerability exists in PostCSS versions before 8.4.31, affecting its ability to securely parse external untrusted CSS. Attackers can manipulate CSS content to include malicious code within comments. During processing, this malicious content can inadvertently be parsed and included in the output as legitimate CSS nodes, which may lead to significant security risks. Users of PostCSS should update to the latest version to mitigate this vulnerability.

References