Executive brief
css-what is a JavaScript library used to parse CSS selectors. A flaw in versions 4.0.0 through 5.0.0 allows attackers to cause the application to hang or become unresponsive by crafting malicious CSS selectors with complex attribute patterns. This could disrupt services that rely on this library to parse user-supplied CSS input.
Technical details
The vulnerability is a denial-of-service flaw (CWE-400: Uncontrolled Resource Consumption) caused by inefficient attribute parsing that does not guarantee linear time complexity relative to input size. Attackers can provide specially crafted CSS selectors with attribute patterns that trigger exponential or polynomial time parsing, causing resource exhaustion. The vulnerability affects versions 4.0.0 through 5.0.0 and is exploitable via network when the library is exposed through a web service or application that processes user-supplied CSS selectors. The fix, released in version 5.0.1, hand-rolls the attribute parsing logic to ensure linear time complexity.
Affected products
- Facebook css-what 4.0.0 through 5.0.0
Timeline
- 2021-05-28: disclosed
- 2021-05-28: patched: Version 5.0.1 released with fix