{"id":"CVE-2023-44270","aliases":["CLSA-2026-1774830263","CLSA-2026-1776299672","CLSA-2026-1777509599","CLSA-2026-1779065188","CLSA-2026-1779065193","CLSA-2026-1779065198","CLSA-2026-1779324473","CLSA-2026-1779670117","CLSA-2026-1786374683","CLSA-2026-1790604941","CLSA-2026-1792164288","CLSA-2026-1793099949","DEBIAN-CVE-2023-44270","DLA-4003-1","EUVD-2023-2456","GHSA-7fh5-64p2-3v2j","ROOT-APP-NPM-CVE-2023-44270","UBUNTU-CVE-2023-44270","openSUSE-SU-2025:14663-1"],"status":"published","title":"PostCSS line return parsing error","description":"An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00973,"percentile":0.62506,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-144","CWE-74"],"published":"2023-09-29T00:00:00Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"npm","package":"postcss","fixed_in":["8.4.31"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"postcss","fixed_in":["8.4.14-tuxcare.1","8.3.6-tuxcare.4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-postcss","fixed_in":["8.4.20+~cs8.0.23-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-postcss","fixed_in":["8.4.31+~cs8.0.26-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-postcss","fixed_in":["8.4.31+~cs8.0.26-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"postcss","fixed_in":["7.0.39-aikido.2","7.0.39-aikido.3","5.2.18-aikido.3","7.0.39-aikido.4","7.0.39-aikido.5","7.0.39-aikido.6","5.2.18-aikido.4","7.0.39-aikido.7","5.2.18-aikido.5","8.4.31-aikido.1","8.4.31-aikido.2","8.4.31-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/postcss","fixed_in":["7.0.39-root.io.2","7.0.39-root.io.1","7.0.39-root.io.3","5.2.18-root.io.3","7.0.39-root.io.4","7.0.39-root.io.5","7.0.39-root.io.6","5.2.18-root.io.4","7.0.39-root.io.7","5.2.18-root.io.5","8.4.31-root.io.1","8.4.31-root.io.2","8.4.31-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.31"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.18-tuxcare.0"},{"fixed":"5.2.18-tuxcare.1"}]}],"versions":["5.2.18"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.14-tuxcare.0"},{"fixed":"7.0.14-tuxcare.1"}]}],"versions":["7.0.14"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.14-tuxcare.0"},{"fixed":"8.4.14-tuxcare.1"}]}],"versions":["8.4.14"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.15-tuxcare.0"},{"fixed":"8.2.15-tuxcare.1"}]}],"versions":["8.2.15"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.5-tuxcare.0"},{"fixed":"8.4.5-tuxcare.1"}]}],"versions":["8.4.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.21-tuxcare.0"},{"fixed":"7.0.21-tuxcare.1"}]}],"versions":["7.0.21"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.32-tuxcare.0"},{"fixed":"7.0.32-tuxcare.1"}]}],"versions":["7.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.17-tuxcare.0"},{"fixed":"7.0.17-tuxcare.1"}]}],"versions":["7.0.17"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.3.6-tuxcare.0"},{"fixed":"8.3.6-tuxcare.4"}]}],"versions":["8.3.6","8.3.6-tuxcare.1","8.3.6-tuxcare.2","8.3.6-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.1-tuxcare.0"},{"fixed":"6.0.1-tuxcare.1"}]}],"versions":["6.0.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.17-tuxcare.0"},{"fixed":"8.4.17-tuxcare.1"}]}],"versions":["8.4.17"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.9-tuxcare.0"},{"fixed":"8.2.9-tuxcare.3"}]}],"versions":["8.2.9","8.2.9-tuxcare.1","8.2.9-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.20+~cs8.0.23-1+deb12u1"}]}],"versions":["8.4.20+~cs8.0.23-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.31+~cs8.0.26-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.31+~cs8.0.26-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.1+~cs5.3.23-8+deb11u1"}]}],"versions":["8.2.1+~cs5.3.23-8"],"bundled":3},{"source":"osv","ecosystem":"npm","package":"postcss","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.4.31"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.39-aikido.2"},{"fixed":"7.0.39-aikido.3"},{"fixed":"5.2.18-aikido.3"},{"fixed":"7.0.39-aikido.4"},{"fixed":"7.0.39-aikido.5"},{"fixed":"7.0.39-aikido.6"},{"fixed":"5.2.18-aikido.4"},{"fixed":"7.0.39-aikido.7"},{"fixed":"5.2.18-aikido.5"},{"fixed":"8.4.31-aikido.1"},{"fixed":"8.4.31-aikido.2"},{"fixed":"8.4.31-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.39-root.io.2"},{"fixed":"7.0.39-root.io.1"},{"fixed":"7.0.39-root.io.3"},{"fixed":"5.2.18-root.io.3"},{"fixed":"7.0.39-root.io.4"},{"fixed":"7.0.39-root.io.5"},{"fixed":"7.0.39-root.io.6"},{"fixed":"5.2.18-root.io.4"},{"fixed":"7.0.39-root.io.7"},{"fixed":"5.2.18-root.io.5"},{"fixed":"8.4.31-root.io.1"},{"fixed":"8.4.31-root.io.2"},{"fixed":"8.4.31-root.io.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.23-1","6.0.23-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.2.1+~cs5.3.23-8","8.4.5+~cs7.1.51-2","8.4.6+~cs7.3.21-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.20+~cs8.0.23-1","8.4.31+~cs8.0.26-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.49+~cs9.2.32-1","8.5.6+~cs9.3.28-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.5.8+~cs9.3.30-1","8.5.15+~cs9.3.34-1","8.5.15+~cs9.3.38-1","8.5.15+~cs9.3.39-1build1","8.5.25+~cs10.2.23-1","8.5.26+~cs10.2.24-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.5.6+~cs9.3.28-1","8.5.8+~cs9.3.30-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.4.git142.862ef23-1.1"}]}],"bundled":27}],"products":[{"vendor":"postcss","product":"postcss"}],"references":[{"url":"https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25","tags":["x_transferred","Issue Tracking","web","report"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.4.31","tags":["x_transferred","Patch","Release Notes","web","report"]},{"url":"https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5","tags":["x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/github/advisory-database/issues/2820","tags":["x_transferred","Issue Tracking","report","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44270","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7fh5-64p2-3v2j"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44270.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-44270","tags":["advisory"]},{"url":"https://github.com/postcss/postcss","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-44270","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44270","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6104","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-44270","description":"An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.","status":"published","published":"2023-09-29T00:00:00Z","modified":"2025-11-03T21:49:45.559Z","updated_at":"2026-11-02T14:35:21.232549Z"}],"euvd":[{"id":"EUVD-2023-2456","description":"An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.","status":"published","published":"2023-09-29T00:00:00Z","modified":"2025-11-03T21:49:45Z","updated_at":"2026-11-02T19:49:30.775561Z"}],"ghsa":[{"id":"GHSA-7fh5-64p2-3v2j","title":"PostCSS line return parsing error","description":"An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be `\\r` discrepancies, as demonstrated by `@font-face{ font:(\\r/*);}` in a rule.\n\nThis vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.","status":"published","published":"2023-09-30T00:31:10Z","modified":"2025-11-04T16:45:03Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-74","CWE-144"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2023-44270","description":"An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.","status":"published","published":"2023-09-29T22:15:11.867Z","modified":"2026-06-17T06:27:15.69Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:08:35.022405Z"}],"osv":[{"id":"DEBIAN-CVE-2023-44270","description":"An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.","status":"published","published":"2023-09-29T22:15:11.867Z","modified":"2026-10-26T18:02:49.756967442Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"GHSA-7fh5-64p2-3v2j","title":"PostCSS line return parsing error","description":"An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be `\\r` discrepancies, as demonstrated by `@font-face{ font:(\\r/*);}` in a rule.\n\nThis vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.","status":"published","published":"2023-09-30T00:31:10Z","modified":"2026-09-10T03:49:57.862104145Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-144","CWE-74"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"UBUNTU-CVE-2023-44270","description":"An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.","status":"published","published":"2023-09-29T22:15:00Z","modified":"2026-10-17T12:56:25.907752805Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"CLSA-2026-1774830263","title":"TuxCare security update for postcss (2 CVEs)","description":"TuxCare rebuilt postcss to address 2 CVEs. Fixed in 5.2.18-tuxcare.1.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-15T09:47:48.821344347Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1776299672","title":"TuxCare security update for postcss (3 CVEs)","description":"TuxCare rebuilt postcss to address 3 CVEs. Fixed in 7.0.14-tuxcare.1.","status":"published","published":"2026-08-04T14:52:26Z","modified":"2026-10-15T09:47:49.890461269Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1777509599","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.14-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-15T09:45:48.769898353Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1779065188","title":"TuxCare security update for postcss (2 CVEs)","description":"TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.2.15-tuxcare.1.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-10-15T09:45:28.657574665Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779065193","title":"TuxCare security update for postcss (2 CVEs)","description":"TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.4.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-10-15T09:45:30.923819868Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779065198","title":"TuxCare security update for postcss (4 CVEs)","description":"TuxCare rebuilt postcss to address 4 CVEs. Fixed in 7.0.21-tuxcare.1.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-10-15T09:45:28.666234919Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779324473","title":"TuxCare security update for postcss (4 CVEs)","description":"TuxCare rebuilt postcss to address 4 CVEs. Fixed in 7.0.32-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:48:03.725144745Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779670117","title":"TuxCare security update for postcss (4 CVEs)","description":"TuxCare rebuilt postcss to address 4 CVEs. Fixed in 7.0.17-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:47:50.219691591Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1786374683","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.3.6-tuxcare.4.","status":"published","published":"2026-08-10T15:11:23Z","modified":"2026-10-15T09:46:00.807240317Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1790604941","title":"TuxCare security update for postcss (6 CVEs)","description":"TuxCare rebuilt postcss to address 6 CVEs. Fixed in 6.0.1-tuxcare.1.","status":"published","published":"2026-09-28T14:15:41Z","modified":"2026-10-15T09:48:04.060835227Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792164288","title":"TuxCare security update for postcss (3 CVEs)","description":"TuxCare rebuilt postcss to address 3 CVEs. Fixed in 8.4.17-tuxcare.1.","status":"published","published":"2026-10-16T15:24:48Z","modified":"2026-10-16T16:30:46.813469999Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1793099949","title":"TuxCare security update for postcss (2 CVEs)","description":"TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.2.9-tuxcare.3.","status":"published","published":"2026-10-27T11:19:09Z","modified":"2026-10-27T13:30:09.457081882Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CVE-2023-44270","description":"An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.","status":"published","published":"2023-09-29T00:00:00Z","modified":"2026-10-28T02:31:14.662713495Z","updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"DLA-4003-1","title":"node-postcss - security update","status":"published","published":"2024-12-26T00:00:00Z","modified":"2026-03-09T01:22:23.677212Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"openSUSE-SU-2025:14663-1","title":"velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.7.0.4.git142.862ef23-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-17T00:00:00Z","modified":"2026-02-04T03:47:20.18775Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"ROOT-APP-NPM-CVE-2023-44270","title":"CVE-2023-44270 in postcss - Patched by Root","description":"Root has patched CVE-2023-44270 in the postcss package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-28T07:43:07Z","modified":"2026-08-28T08:45:05.312337409Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}