-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe commit diff shows critical regex modifications in both the main parse function (selector handling) and atcustommedia function (@custom-media rule parsing). The original regex patterns exhibited either inefficient matching (CWE-1333) or insufficient input validation (CWE-20). The patch changes demonstrate: 1) Added nested parenthesis handling in selector regex to prevent ReDoS 2) Tightened pattern matching for custom media queries. These were the direct fixes for the documented CSS parsing vulnerabilities.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @adobe/css-tools | npm | < 4.3.2 | 4.3.2 |