PT-2023-7240 · Adobe · @Adobe/Css-Tools

Holblin

·

Published

2023-08-16

·

Updated

2024-04-24

·

CVE-2023-26364

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Name of the Vulnerable Software and Affected Versions @adobe/css-tools versions 4.3.0 and earlier
Description The issue is related to an Improper Input Validation vulnerability in the CSS parser for Node.js css-tools. This vulnerability could result in a denial of service while attempting to parse CSS. Exploitation of this issue does not require user interaction or privileges.
Recommendations For versions 4.3.0 and earlier, update to version 4.3.1 to resolve the issue. As a temporary workaround, consider restricting the input to the CSS parser to minimize the risk of exploitation.

Fix

DoS

RCE

Weakness Enumeration

CWE-1333CWE-20

Related Identifiers

BDU:2023-08268
CVE-2023-26364
GHSA-HPX4-R86G-5JRG
SUSE-SU-2024:1415-1
SUSE-SU-2024:1415-2
SUSE-SU-2024:1416-1

Affected Products

@Adobe/Css-Tools