CVE-2023-44270

There's a flaw in the PostCSS package where it fails to properly validate the input CSS, causing commented lines to be interpreted as code. An attacker may leverage that by crafting a CSS file with comments containing CSS code in order to force PostCSS to include the malicious CSS elements in its output. An successful attack may lead to integrity impact as it may inject elements in a web page when parsing untrusted CSS input.

Moderate impact. Red Hat products in the current affected scope that use the PostCSS component to parse external, untrusted CSS may allow an attacker to craft CSS comments that PostCSS incorrectly interprets as CSS nodes, causing commented content to be emitted as rules or properties. This may result in CSS injection and integrity impact, including injection of elements into a web page when untrusted CSS is parsed. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The current scope contains affected delegated records across Red Hat products and components, as well as records whose delegated resolution is NOTAFFECTED; those components are not affected according to the current product assessment, and no more specific technical justification is recorded.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.