Skip to content
Fencer Vulns
medium 5.3

CVE-2023-44270 json

PostCSS line return parsing error

published 2023-09-29 3 y ago modified 2026-09-10 1 mo ago also GHSA-7fh5-64p2-3v2j , EUVD-2023-2456

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits
0
none known

Summary

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

Patch / fix

  • npm postcss 8.4.31
  • postcss postcss 8.4.31
  • node-postcss Debian 12 8.4.20+~cs8.0.23-1+deb12u1
  • node-postcss Debian 14, Debian 13 8.4.31+~cs8.0.26-1

debian advisories DEBIAN-CVE-2023-44270

  • velociraptor openSUSE Tumbleweed 0.7.0.4.git142.862ef23-1.1

opensuse advisories openSUSE-SU-2025:14663-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-44270 updated cvss 5.3

PostCSS: Improper input validation in PostCSS

  • Red Hat Cryostat 3 io.cryostat-cryostat3 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8, openshift-logging/logging-view-plugin-rhel9 Red Hat Migration Toolkit for Applications 7 mta/mta-ui-rhel9, mta/mta-cli-rhel9 Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-ui-rhel8 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-console-plugin-rhel9
    affected: workaround, no fix available “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.”
  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/multicluster-engine-console-mce-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8
    affected: workaround, no fix planned “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.”
  • Red Hat OpenShift Lightspeed lightspeed-console-plugin-rhel9
    affected: workaround, no fix available “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.”
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-hub-db-migration-rhel8
    affected: workaround, no fix available, no fix planned “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.”
  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-ossmc-rhel8
    affected: workaround, no fix available “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.”
  • Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel7 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel8
    affected: workaround, no fix planned “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.”
  • Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8
    affected: workaround, no fix available “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.”
  • Red Hat Ansible Automation Platform 2 aap-cloud-ui-container, ansible-automation-platform-25/lightspeed-rhel8
    affected: workaround, no fix available, no fix planned “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.”
show 14 more
  • Red Hat build of Apicurio Registry 2 io.apicurio-apicurio-registry Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9
    affected: workaround, no fix available “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.”
  • Red Hat Data Grid 8 org.infinispan-infinispan-console Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 7 thunderbird Red Hat Enterprise Linux 8 pcs, grafana, pcs-snmp, grafana-loki, grafana-mssql, grafana-mysql, +10 more Red Hat Enterprise Linux 9 pcs, grafana, pcs-snmp, grafana-selinux Red Hat Enterprise Linux 10 grafana
    +2 more products
    Red Hat Fuse 7 io.apicurio-apicurito, io.syndesis-syndesis-parent Red Hat Integration Camel K 1 io.apicurio-apicurio-registry
    affected: workaround, no fix planned “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.”
  • Red Hat JBoss Data Grid 7 org.jboss.hal-hal-parent, org.infinispan-infinispan-management-console
    affected: workaround, no fix available “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.”
  • Red Hat OpenShift AI (RHOAI) odh-dashboard-container
    affected: workaround, no fix planned “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.”
  • Red Hat Openshift Container Storage 4 ocs4/mcg-core-rhel8 Red Hat OpenShift Data Science (RHODS) rhods/odh-dashboard-rhel8 Red Hat OpenShift Dev Spaces devspaces/dashboard-rhel8 Red Hat OpenShift Virtualization 4 cnv4/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9
    affected: workaround, no fix available “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.”
  • Red Hat Process Automation 7 org.uberfire-uberfire-parent, org.kie-process-migration-service
    affected: workaround, no fix planned “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.”
  • Red Hat Quay 3 quay/quay-rhel8
    affected: workaround, no fix available “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.”
  • Red Hat Satellite 6 nodejs-css-loader, nodejs-css-minimizer-webpack-plugin, nodejs-optimize-css-assets-webpack-plugin
    affected: workaround, no fix available, no fix planned “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.”
  • Red Hat Trusted Artifact Signer rekor-search-ui-rhel9 Red Hat streams for Apache Kafka com.github.streamshub-console
    affected: workaround, no fix available “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.”
  • Red Hat Discovery 1 for RHEL 9 discovery/discovery-ui-rhel9 1.12.0-1, discovery/discovery-server-rhel9 1.12.0-1
    fixed: vendor fix “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.” RHSA-2025:1249
  • Red Hat OpenShift Container Platform 4.17 openshift4/nmstate-console-plugin-rhel9 v4.17.0-202411261204.p0.gbc40e56.assembly.stream.el9, openshift4/ose-networking-console-plugin-rhel9 v4.17.0-202501150934.p0.g0244dff.assembly.stream.el9
    fixed: vendor fix “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.” RHSA-2024:10517
  • Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202502100215-0, openshift4/frr-rhel9 v4.18.0-202502041302.p0.g1ad8f2e.assembly.stream.el9, openshift4/metallb-rhel9 v4.18.0-202502041632.p0.gdcee704.assembly.stream.el9, openshift4/ose-cli-rhel9 v4.18.0-202502040032.p0.ga50d4c0.assembly.stream.el9, openshift4/ose-pod-rhel9 v4.18.0-202502051032.p0.gacb9630.assembly.stream.el9, openshift4/ose-ptp-rhel9 v4.18.0-202501230001.p0.gcc2e8c8.assembly.stream.el9, +237 more
    fixed: vendor fix “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.” RHSA-2024:6122
  • Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel9 3.18-6, devspaces/dashboard-rhel9 3.18-10
    fixed: vendor fix “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.” RHSA-2025:0892
  • Red Hat OpenShift GitOps 1.14 openshift-gitops-1/dex-rhel8 v1.14.3-4, openshift-gitops-1/argocd-rhel8 v1.14.3-4, openshift-gitops-1/argocd-rhel9 v1.14.3-1, openshift-gitops-1/gitops-rhel8 v1.14.3-4, openshift-gitops-1/must-gather-rhel8 v1.14.3-4, openshift-gitops-1/kam-delivery-rhel8 v1.14.3-4, +4 more
    fixed: vendor fix “There's no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.” RHSA-2025:3069

6 more fixed, 24 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.97% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm postcss
<8.4.31
8.4.31

Classification

Weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
  • CWE-144 Improper Neutralization of Line Delimiters

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.