CVE-2023-44270 PostCSS line return parsing error
Attackers can inject malicious CSS via comments in PostCSS, potentially leading to XSS when processed by linters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-44270?
CVE-2023-44270 is a medium-severity cross-site scripting vulnerability in n/a, published on 29 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.
Weakness: CWE-74
Which versions are affected by CVE-2023-44270?
2 open source packages ship an affected version, including postcss. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
postcss npm | All versions | 8.4.31 |
postcss npm | All versions | 8.4.31 |
Products include Postcss Postcss.
How do I fix CVE-2023-44270?
Upgrade postcss to 8.4.31 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-44270 being exploited?
There is no known exploitation of CVE-2023-44270 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-45623 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
- CVE-2026-69153 PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
- CVE-2021-23382 Regular Expression Denial of Service (ReDoS)
- CVE-2021-23368 Regular Expression Denial of Service (ReDoS)
Sources
Also known as CLSA-2026-1777509599, CLSA-2026-1786374683, DEBIAN-CVE-2023-44270, GHSA-7fh5-64p2-3v2j, MINI-g7wj-4589-j6j7, ROOT-APP-NPM-CVE-2023-44270 and 1 more.