Css-what Project

Records2All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

Css-what Project records in CISA KEV

No Css-what Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Css-what 2 records HIGH

Records

2 records

TI-2022-05615 CVE-2022-21222 · GHSA-p28h-cc7q-c4fg

Regular expression denial of service (ReDoS) in css-what

HIGH 72

The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01904 Published 2022-09-30 Partial fix · 2.1.3 CWE-1333

TI-2021-12971 CVE-2021-33587 · GHSA-q8pj-2vqx-8ggc

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute…

LOW 37

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02036 Published 2021-05-28 Partial fix · 5.0.1 CWE-400

Open these records in search →

Critical	0
High	2
Medium	0
Low	0
No CVSS	0