Where is the vulnerability in CVE-2023-44270?

[ThiefMaster]

Neither the CVE nor the release notes nor the commit message are clear about how this is anything more than just a bug.

Is it ReDoS? Other DoS? Something worse? Because at least DoS is typically irrelevant in build tools (and should usually not be considered vulnerabilities but just bugs).

[ai]

You are having vulnerability if you are using PostCSS to parse CSS from your users and validate these CSS files by PostCSS.

Attacker can create CSS where some part will be invisible to PostCSS, but visible to browsers.

[ThiefMaster]

Thanks, exactly the kind of clarification I was looking for - so as I thought: When used as a build tool it's just a bug (that's not even particularly problematic in most cases).

[ai]

I post a tweet for other people https://twitter.com/PostCSS/status/1709315105106567453

[lhtdesignde]

Thank for the explanation. Is it fixed in PostCSS 8.4.31? Because I have that version but my dependabot still complains. 🤔

[Semigradsky]

GHSA-7fh5-64p2-3v2j

I see that affected version are < 8.4.31

[lhtdesignde]

yes me too, but still i cannot resolve the alert. Guessing then some other packages need to update then as well.

[ThiefMaster]

You may want to dismiss the alert if you do not use it in a place where the issue is relevant (e.g. if you just use as a dev tool) :)

[lhtdesignde]

Ok thank you!

[ai]

Because I have that version but my dependabot still complains.

You may have another PostCSS versions as a nested dependencies inside your other tool. Check npm/yarn/pnpm lock file.

[hackel]

Is there a chance of the fix for this issue being backported to postcss 7.x?

[ai]

Mostly, no. PostCSS 8 was released 3 years ago.

I will back port fixes only if some big PostCSS sponsor will ask for that because supporting legacy is not fun, but a job.