Regular Expression Denial of Service in postcss
Moderate severity
GitHub Reviewed
Published
Jan 7, 2022
to the GitHub Advisory Database
•
Updated Sep 8, 2023
Description
Published by the National Vulnerability Database
Apr 26, 2021
Reviewed
May 20, 2021
Published to the GitHub Advisory Database
Jan 7, 2022
Last updated
Sep 8, 2023
The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern
PoC
References