Executive brief
PostCSS is a JavaScript tool used to parse and transform CSS stylesheets, widely used by web developers and linters to validate external CSS files. A parsing error allows attackers to craft malicious CSS that hides arbitrary content within what should be parsed as comments; after PostCSS processing, this hidden content appears in the output as legitimate CSS rules or properties, potentially enabling CSS injection attacks in linting workflows.
Technical details
PostCSS before version 8.4.31 contains a parsing error in its tokenization logic when handling carriage return (\r) characters in CSS. The vulnerability allows crafted CSS input—such as @font-face{ font:(\r/*);} —to be parsed inconsistently: content intended to be within a comment block is incorrectly recognized as legitimate CSS and appears in the parsed output. This affects tools and linters that use PostCSS to parse untrusted or external CSS files. An attacker supplying malicious CSS can inject rules or properties that should have been ignored, leading to CSS injection. The vulnerability was fixed in version 8.4.31 (commit 58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5).
Affected products
- PostCSS PostCSS before 8.4.31
Timeline
- 2023-09-30: disclosed
- 2023-09-29: patched: Fixed in version 8.4.31