PT-2022-14933 · Css-What+2 · Css-What+2

Joe Portner · Published 2022-09-30 · Updated 2025-05-20 · CVE-2022-21222

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions css-what versions prior to 2.1.3

Description The issue is related to a Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression in the re attr variable of index.js. This could be triggered via the parse function.

Recommendations For versions prior to 2.1.3, update to version 2.1.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the parse function until a patch is available. Avoid using the re attr variable in the affected index.js file until the issue is resolved.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

CVE-2022-21222

DLA-3350-1

GHSA-P28H-CC7Q-C4FG

USN-6065-1

Affected Products

Linuxmint

Ubuntu

Css-What

References · 19

• 🔥 https://security.snyk.io/vuln/SNYK-JS-CSSWHAT-3035488 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-21222 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-33587 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21222 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-21222 · Security Note
• https://osv.dev/vulnerability/USN-6065-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-21222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21222 · Security Note
• https://osv.dev/vulnerability/DLA-3350-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p28h-cc7q-c4fg · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6065-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21222 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-21222 · Vendor Advisory
• https://github.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.js%23L12 · Note
• https://github.com/fb55/css-what/commit/dc510929790da6617e7aa93a616498b22f6a6b72 · Note