CVE-2023-48631

Denial of Service of regular expression in package @adobe/css-tools

5.3 MediumFix available

@adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

1.11%Up 1.1 points since Dec 15, 2023

What each source reports

CVE List Score used 5.3

Denial of Service of regular expression in package @adobe/css-tools

@adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.

Record: CVE-2023-48631
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-20
Updated: 2026-11-02

EUVDEUVD-2023-3011 5.3

@adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.

Record: EUVD-2023-3011
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-prr3-c3m5-p7q2 5.0

@adobe/css-tools Improper Input Validation and Inefficient Regular Expression Complexity

Impact

@adobe/css-tools version 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.

Patches

The issue has been resolved in 4.3.2.

Workarounds

None

References

N/A

Record: GHSA-prr3-c3m5-p7q2
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Weakness: CWE-20, CWE-1333
Updated: 2026-11-02

NVD 5.3

@adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.

Record: CVE-2023-48631
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-20, CWE-1333
Updated: 2026-11-02

OSVGHSA-prr3-c3m5-p7q2 5.0

@adobe/css-tools Improper Input Validation and Inefficient Regular Expression Complexity

Impact

@adobe/css-tools version 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.

Patches

The issue has been resolved in 4.3.2.

Workarounds

None

References

N/A

Record: GHSA-prr3-c3m5-p7q2
CVSS 3.1: 5.0 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Weakness: CWE-1333, CWE-20
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`@adobe/css-tools` npm	before 4.3.2	4.3.2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-48631 is a medium vulnerability (CVSS 5.3) in Adobe Css-tools, published November 30, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 66th percentile. Fixed in @adobe/css-tools 4.3.2.