Is CVE-2023-44270 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-44270 being exploited in the wild.

How severe is CVE-2023-44270?

Low severity, with a CVSS score of 3.1, published 30 September 2023.

Which products and versions are affected?

postcss (npm) SEMVER:introduced=0,fixed=8.4.31.

Is there a fix for CVE-2023-44270?

Yes. postcss (npm): upgrade to 8.4.31 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-44270 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-44270?

Check whether you run postcss (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-44270: PostCSS line return parsing error in CSS tokenization

CVE-2023-44270 · Severity: low · CVSS 3.1 · Published 2023-09-30

PostCSS is a JavaScript tool used to parse and transform CSS stylesheets, widely used by web developers and linters to validate external CSS files. A parsing error allows attackers to craft malicious CSS that hides arbitrary content within what should be parsed as comments; after PostCSS processing, this hidden content appears in the output as legitimate CSS rules or properties, potentially enabling CSS injection attacks in linting workflows.

Technologies: postcss (npm). Vendors: npm.

Quick answers

Is CVE-2023-44270 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-44270 being exploited in the wild.
How severe is CVE-2023-44270?: Low severity, with a CVSS score of 3.1, published 30 September 2023.
Which products and versions are affected?: postcss (npm) SEMVER:introduced=0,fixed=8.4.31.
Is there a fix for CVE-2023-44270?: Yes. postcss (npm): upgrade to 8.4.31 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-44270 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-44270?: Check whether you run postcss (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

postcss (npm): upgrade to 8.4.31 or later
```
npm install postcss@8.4.31
```

Technical details

PostCSS before version 8.4.31 contains a parsing error in its tokenization logic when handling carriage return (\r) characters in CSS. The vulnerability allows crafted CSS input—such as @font-face{ font:(\r/*);} —to be parsed inconsistently: content intended to be within a comment block is incorrectly recognized as legitimate CSS and appears in the parsed output. This affects tools and linters that use PostCSS to parse untrusted or external CSS files. An attacker supplying malicious CSS can inject rules or properties that should have been ignored, leading to CSS injection. The vulnerability was fixed in version 8.4.31 (commit 58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5).

Affected products

PostCSS PostCSS before 8.4.31

Identifiers

CVE-2023-44270
GHSA-7fh5-64p2-3v2j

Timeline

2023-09-30: disclosed
2023-09-29: patched: Fixed in version 8.4.31

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.