nvd-json-data-feeds/CVE-2023/CVE-2023-442xx/CVE-2023-44270.json

{
  "id": "CVE-2023-44270",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2023-09-29T22:15:11.867",
  "lastModified": "2023-10-10T13:15:22.197",
  "vulnStatus": "Undergoing Analysis",
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment."
    },
    {
      "lang": "es",
      "value": "Se descubri\u00f3 un problema en PostCSS antes de la versi\u00f3n 8.4.31. Afecta a los linters que utilizan PostCSS para analizar hojas de estilos en cascada (CSS) externas. Puede haber \\r discrepancies, como lo demuestra @font-face{ font:(\\r/*);} en una regla."
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://github.com/github/advisory-database/issues/2820",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/postcss/postcss/releases/tag/8.4.31",
      "source": "cve@mitre.org"
    }
  ]
}