CVE-2023-48631: @adobe/css-tools Improper Input Validation and Inefficient Regular Expression Complexity
Summary
CVE-2023-48631: @adobe/css-tools Improper Input Validation and Inefficient Regular Expression Complexity. Affects @adobe/css-tools versions < 4.3.2. Fixed in 4.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @adobe/css-tools package is an open-source library that provides tools for parsing and manipulating CSS. It is commonly used in web development projects to handle CSS-related tasks. The package offers various functionalities, including CSS parsing, validation, and transformation. However, versions 4.3.1 and earlier of @adobe/css-tools are vulnerable to an Improper Input Validation issue, which can lead to a denial of service when attempting to parse CSS files.
Vulnerability Detail
The vulnerability in @adobe/css-tools arises from improper input validation and inefficient regular expression complexity. This vulnerability allows an attacker to craft malicious CSS files that can cause the parsing process to consume excessive resources, leading to a denial of service. By exploiting this vulnerability, an attacker could disrupt the functionality of applications or services that rely on @adobe/css-tools for CSS parsing. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.0.
How To Fix
Minimum fixed version
4.3.2
This is the first release that contains the fix.
npm install @adobe/css-tools@4.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The @adobe/css-tools package, specifically versions 4.3.1 and earlier, is vulnerable to an Improper Input Validation and Inefficient Regular Expression Complexity issue. This vulnerability can be exploited to cause a denial of service by parsing malicious CSS files. To mitigate this risk, it is crucial to update to version 4.3.2 or later. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for @adobe/css-tools →
FAQ
@adobe/css-tools is an open-source library used for parsing and manipulating CSS files in web development projects.
The vulnerability can result in a denial of service when parsing CSS files, potentially disrupting the functionality of applications or services that rely on @adobe/css-tools.
Versions 4.3.1 and earlier of @adobe/css-tools are affected by this vulnerability.
To fix this vulnerability, update @adobe/css-tools to version 4.3.2 or later.
No, there is no known workaround for this vulnerability. Updating to the patched version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for @adobe/css-tools.
