CVE-2023-44270
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.
- Record
CVE-2023-44270- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.
- Record
CVE-2023-44270- Updated
- 2026-11-02
EUVDEUVD-2023-2456 No score
An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.
- Record
EUVD-2023-2456- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7fh5-64p2-3v2j
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
- Record
GHSA-7fh5-64p2-3v2j- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-74, CWE-144
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-44270
An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.
- Record
DEBIAN-CVE-2023-44270- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-7fh5-64p2-3v2j
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.
This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.
- Record
GHSA-7fh5-64p2-3v2j- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-144, CWE-74
- Updated
- 2026-11-02
Show 16 moreShow less
OSVUBUNTU-CVE-2023-44270
An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.
- Record
UBUNTU-CVE-2023-44270- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1774830263 No score
TuxCare security update for postcss (2 CVEs)
TuxCare rebuilt postcss to address 2 CVEs. Fixed in 5.2.18-tuxcare.1.
- Record
CLSA-2026-1774830263- Updated
- 2026-11-02
OSVCLSA-2026-1776299672 No score
TuxCare security update for postcss (3 CVEs)
TuxCare rebuilt postcss to address 3 CVEs. Fixed in 7.0.14-tuxcare.1.
- Record
CLSA-2026-1776299672- Updated
- 2026-11-02
OSVCLSA-2026-1777509599 No score
TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.14-tuxcare.1.
- Record
CLSA-2026-1777509599- Updated
- 2026-11-02
OSVCLSA-2026-1779065188 No score
TuxCare security update for postcss (2 CVEs)
TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.2.15-tuxcare.1.
- Record
CLSA-2026-1779065188- Updated
- 2026-11-02
OSVCLSA-2026-1779065193 No score
TuxCare security update for postcss (2 CVEs)
TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.4.5-tuxcare.1.
- Record
CLSA-2026-1779065193- Updated
- 2026-11-02
OSVCLSA-2026-1779065198 No score
TuxCare security update for postcss (4 CVEs)
TuxCare rebuilt postcss to address 4 CVEs. Fixed in 7.0.21-tuxcare.1.
- Record
CLSA-2026-1779065198- Updated
- 2026-11-02
OSVCLSA-2026-1779324473 No score
TuxCare security update for postcss (4 CVEs)
TuxCare rebuilt postcss to address 4 CVEs. Fixed in 7.0.32-tuxcare.1.
- Record
CLSA-2026-1779324473- Updated
- 2026-11-02
OSVCLSA-2026-1779670117 No score
TuxCare security update for postcss (4 CVEs)
TuxCare rebuilt postcss to address 4 CVEs. Fixed in 7.0.17-tuxcare.1.
- Record
CLSA-2026-1779670117- Updated
- 2026-11-02
OSVCLSA-2026-1786374683 No score
TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.3.6-tuxcare.4.
- Record
CLSA-2026-1786374683- Updated
- 2026-11-02
OSVCLSA-2026-1790604941 No score
TuxCare security update for postcss (6 CVEs)
TuxCare rebuilt postcss to address 6 CVEs. Fixed in 6.0.1-tuxcare.1.
- Record
CLSA-2026-1790604941- Updated
- 2026-11-02
OSVCLSA-2026-1792164288 No score
TuxCare security update for postcss (3 CVEs)
TuxCare rebuilt postcss to address 3 CVEs. Fixed in 8.4.17-tuxcare.1.
- Record
CLSA-2026-1792164288- Updated
- 2026-11-02
OSVCLSA-2026-1793099949 No score
TuxCare security update for postcss (2 CVEs)
TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.2.9-tuxcare.3.
- Record
CLSA-2026-1793099949- Updated
- 2026-11-02
OSV No score
An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.
- Record
CVE-2023-44270- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14663-1 No score
velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media
These are all security issues fixed in the velociraptor-0.7.0.4.git142.862ef23-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14663-1- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2023-44270 No score
CVE-2023-44270 in postcss - Patched by Root
Root has patched CVE-2023-44270 in the postcss package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2023-44270- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
postcssnpm |
before 8.4.31 | 8.4.31 |
postcssTuxCare:npm From an advisory covering 2 CVEs |
5.2.18-tuxcare.0 up to 5.2.18-tuxcare.1, plus listed versions 5.2.18 |
5.2.18-tuxcare.1 |
postcssTuxCare:npm From an advisory covering 3 CVEs |
7.0.14-tuxcare.0 up to 7.0.14-tuxcare.1, plus listed versions 7.0.14 |
7.0.14-tuxcare.1 |
postcssTuxCare:npm |
8.4.14-tuxcare.0 up to 8.4.14-tuxcare.1, plus listed versions 8.4.14 |
8.4.14-tuxcare.1 |
postcssTuxCare:npm From an advisory covering 2 CVEs |
8.2.15-tuxcare.0 up to 8.2.15-tuxcare.1, plus listed versions 8.2.15 |
8.2.15-tuxcare.1 |
postcssTuxCare:npm From an advisory covering 2 CVEs |
8.4.5-tuxcare.0 up to 8.4.5-tuxcare.1, plus listed versions 8.4.5 |
8.4.5-tuxcare.1 |
postcssTuxCare:npm From an advisory covering 4 CVEs |
7.0.21-tuxcare.0 up to 7.0.21-tuxcare.1, plus listed versions 7.0.21 |
7.0.21-tuxcare.1 |
postcssTuxCare:npm From an advisory covering 4 CVEs |
7.0.32-tuxcare.0 up to 7.0.32-tuxcare.1, plus listed versions 7.0.32 |
7.0.32-tuxcare.1 |
postcssTuxCare:npm From an advisory covering 4 CVEs |
7.0.17-tuxcare.0 up to 7.0.17-tuxcare.1, plus listed versions 7.0.17 |
7.0.17-tuxcare.1 |
postcssTuxCare:npm |
8.3.6-tuxcare.0 up to 8.3.6-tuxcare.4, plus listed versions 8.3.68.3.6-tuxcare.18.3.6-tuxcare.28.3.6-tuxcare.3 |
8.3.6-tuxcare.4 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
postcssTuxCare:npm From an advisory covering 6 CVEs |
6.0.1-tuxcare.0 up to 6.0.1-tuxcare.1, plus listed versions 6.0.1 |
6.0.1-tuxcare.1 |
postcssTuxCare:npm From an advisory covering 3 CVEs |
8.4.17-tuxcare.0 up to 8.4.17-tuxcare.1, plus listed versions 8.4.17 |
8.4.17-tuxcare.1 |
postcssTuxCare:npm From an advisory covering 2 CVEs |
8.2.9-tuxcare.0 up to 8.2.9-tuxcare.3, plus listed versions 8.2.98.2.9-tuxcare.18.2.9-tuxcare.2 |
8.2.9-tuxcare.3 |
node-postcssDebian:12 |
before 8.4.20+~cs8.0.23-1+deb12u1, plus listed versions 8.4.20+~cs8.0.23-1 |
8.4.20+~cs8.0.23-1+deb12u1 |
node-postcssDebian:13 |
before 8.4.31+~cs8.0.26-1 | 8.4.31+~cs8.0.26-1 |
node-postcssDebian:14 |
before 8.4.31+~cs8.0.26-1 | 8.4.31+~cs8.0.26-1 |
node-postcssDebian:11 From an advisory covering 3 CVEs |
before 8.2.1+~cs5.3.23-8+deb11u1, plus listed versions 8.2.1+~cs5.3.23-8 |
8.2.1+~cs5.3.23-8+deb11u1 |
postcssRoot:npm |
before 7.0.39-aikido.2 | 7.0.39-aikido.27.0.39-aikido.35.2.18-aikido.37.0.39-aikido.47.0.39-aikido.57.0.39-aikido.65.2.18-aikido.47.0.39-aikido.75.2.18-aikido.58.4.31-aikido.18.4.31-aikido.28.4.31-aikido.4 |
@rootio/postcssRoot:npm |
before 7.0.39-root.io.2 | 7.0.39-root.io.27.0.39-root.io.17.0.39-root.io.35.2.18-root.io.37.0.39-root.io.47.0.39-root.io.57.0.39-root.io.65.2.18-root.io.47.0.39-root.io.75.2.18-root.io.58.4.31-root.io.18.4.31-root.io.28.4.31-root.io.4 |
node-postcssUbuntu:20.04:LTS |
All versions, plus listed versions 6.0.23-16.0.23-3 |
None known |
node-postcssUbuntu:22.04:LTS |
All versions, plus listed versions 8.2.1+~cs5.3.23-88.4.5+~cs7.1.51-28.4.6+~cs7.3.21-1 |
None known |
node-postcssUbuntu:24.04:LTS |
All versions, plus listed versions 8.4.20+~cs8.0.23-18.4.31+~cs8.0.26-1 |
None known |
node-postcssUbuntu:25.10 |
All versions, plus listed versions 8.4.49+~cs9.2.32-18.5.6+~cs9.3.28-1 |
None known |
node-postcssUbuntu:26.10 |
All versions, plus listed versions 8.5.8+~cs9.3.30-18.5.15+~cs9.3.34-18.5.15+~cs9.3.38-18.5.15+~cs9.3.39-1build18.5.25+~cs10.2.23-18.5.26+~cs10.2.24-1 |
None known |
node-postcssUbuntu:26.04:LTS |
All versions, plus listed versions 8.5.6+~cs9.3.28-18.5.8+~cs9.3.30-1 |
None known |
velociraptoropenSUSE:Tumbleweed From an advisory covering 27 CVEs |
before 0.7.0.4.git142.862ef23-1.1 | 0.7.0.4.git142.862ef23-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-44270 is a medium vulnerability (CVSS 5.3) in Postcss, published September 29, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 62nd percentile. Fixed in postcss 8.4.31.
References
github.com/postcss/postcss/blob/main/lib/tokenize.js
lists.debian.org/debian-lts-announce/2024/12/msg00025.html
nvd.nist.gov/vuln/detail/CVE-2023-44270
Show 34 moreShow less
security-tracker.debian.org/tracker/CVE-2023-44270
ubuntu.com/security/CVE-2023-44270
cve.org/CVERecord?id=CVE-2023-44270
lists.opensuse.org/archives/list/[email protected]/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK
suse.com/security/cve/CVE-2023-1732