Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-b47r-t8mv-xkd4
Vulnerability ID VCID-b47r-t8mv-xkd4
Aliases CVE-2023-44270
GHSA-7fh5-64p2-3v2j
Summary PostCSS line return parsing error An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be `\r` discrepancies, as demonstrated by `@font-face{ font:(\r/*);}` in a rule. This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-144 Improper Neutralization of Line Delimiters
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
System Score Found at
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-44270.json
epss 0.00166 https://api.first.org/data/v1/epss?cve=CVE-2023-44270
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-7fh5-64p2-3v2j
cvssv3.1 5.3 https://github.com/github/advisory-database/issues/2820
generic_textual MODERATE https://github.com/github/advisory-database/issues/2820
ssvc Track https://github.com/github/advisory-database/issues/2820
cvssv3.1 5.3 https://github.com/postcss/postcss
generic_textual MODERATE https://github.com/postcss/postcss
cvssv3.1 5.3 https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25
generic_textual MODERATE https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25
ssvc Track https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25
cvssv3.1 5.3 https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5
generic_textual MODERATE https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5
ssvc Track https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5
cvssv3.1 5.3 https://github.com/postcss/postcss/releases/tag/8.4.31
generic_textual MODERATE https://github.com/postcss/postcss/releases/tag/8.4.31
ssvc Track https://github.com/postcss/postcss/releases/tag/8.4.31
cvssv3.1 5.3 https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html
generic_textual MODERATE https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2023-44270
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2023-44270
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-44270.json
https://api.first.org/data/v1/epss?cve=CVE-2023-44270
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44270
https://github.com/github/advisory-database/issues/2820
https://github.com/postcss/postcss
https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25
https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5
https://github.com/postcss/postcss/releases/tag/8.4.31
https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html
1053282 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1053282
2326998 https://bugzilla.redhat.com/show_bug.cgi?id=2326998
CVE-2023-44270 https://nvd.nist.gov/vuln/detail/CVE-2023-44270
GHSA-7fh5-64p2-3v2j https://github.com/advisories/GHSA-7fh5-64p2-3v2j
RHSA-2024:10517 https://access.redhat.com/errata/RHSA-2024:10517
RHSA-2024:10908 https://access.redhat.com/errata/RHSA-2024:10908
RHSA-2025:0654 https://access.redhat.com/errata/RHSA-2025:0654
RHSA-2025:0892 https://access.redhat.com/errata/RHSA-2025:0892
RHSA-2025:1824 https://access.redhat.com/errata/RHSA-2025:1824
RHSA-2025:1829 https://access.redhat.com/errata/RHSA-2025:1829
RHSA-2025:1865 https://access.redhat.com/errata/RHSA-2025:1865
RHSA-2025:1866 https://access.redhat.com/errata/RHSA-2025:1866
RHSA-2025:2652 https://access.redhat.com/errata/RHSA-2025:2652
RHSA-2025:3069 https://access.redhat.com/errata/RHSA-2025:3069
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-44270.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/github/advisory-database/issues/2820
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-23T16:38:23Z/ Found at https://github.com/github/advisory-database/issues/2820
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/postcss/postcss
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-23T16:38:23Z/ Found at https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-23T16:38:23Z/ Found at https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://github.com/postcss/postcss/releases/tag/8.4.31
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-23T16:38:23Z/ Found at https://github.com/postcss/postcss/releases/tag/8.4.31
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-44270
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.37354
EPSS Score 0.00166
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T21:02:04.480000+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/postcss/CVE-2023-44270.yml 38.6.0