-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @adobe/css-tools | npm | < 4.3.1 | 4.3.1 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe commit diff shows critical regex modifications in two areas: 1) The @import rule regex was changed from '(:?...)' to '(?:...)' with termination anchors, addressing backtracking. 2) The comment regex was simplified from a complex nested pattern to a non-backtracking '[^]*?' match. The added test case demonstrates exploitation via @import with repeated quote patterns, confirming these were the vulnerable code paths. Both regex patterns exhibited exponential time complexity characteristics typical of ReDOS vulnerabilities.
Ongoing coverage of React2Shell