An issue was discovered in PostCSS before 8.4.31.
Priority LOW 32CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 11 fixed, 35 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00973 62nd percentileScored 2026-11-07
Fix Partial postcss (npm): 8.4.31Red Hat: 13 advisoriesRed Hat: 11 fixed, 35 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | postcss (npm) | before 8.4.31 | 8.4.31 | Patch available | GHSA-7fh5-64p2-3v2j |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- postcss (npm) Vendor— Affected before 8.4.31 Fixed in 8.4.31 Patch available GHSA-7fh5-64p2-3v2j
Remediation
- Fix · GHSA-7fh5-64p2-3v2j postcss (npm) Fixed in 8.4.31 Advisory →
Red Hat 13 advisories
- RHSA-2025:3069 Released 2025-03-20 · Red Hat rating ImportantErrata Advisory for Red Hat OpenShift GitOps v1.14.3 security update
- Red Hat OpenShift GitOps 1.14 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 +7
- RHSA-2025:2652 Released 2025-03-11 · Red Hat rating ImportantRHODF-4.18-RHEL-9 enhancement, bug fix and security update
- RHODF 4.18 for RHEL 9 odf4/cephcsi-rhel9, odf4/ocs-client-console-rhel9, odf4/ocs-metrics-exporter-rhel9 +3
- RHSA-2025:1866 Released 2025-02-26 · Red Hat rating ImportantRHODF-4.14-RHEL-9 security update
- RHODF 4.14 for RHEL 9 odf4/ocs-client-console-rhel9, odf4/ocs-metrics-exporter-rhel9, odf4/ocs-rhel9-operator +3
Show 10 more Red Hat advisories
- RHSA-2025:1865 Released 2025-02-26 · Red Hat rating ImportantRHODF-4.15-RHEL-9 security update
- RHODF 4.15 for RHEL 9 odf4/ocs-client-console-rhel9, odf4/ocs-metrics-exporter-rhel9, odf4/ocs-rhel9-operator +4
- RHSA-2025:1829 Released 2025-02-25 · Red Hat rating ImportantRHODF-4.16-RHEL-9 security update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/ocs-client-console-rhel9, odf4/ocs-rhel9-operator +5
- RHSA-2025:1824 Released 2025-02-25 · Red Hat rating ImportantRHODF-4.17-RHEL-9 security update
- RHODF 4.17 for RHEL 9 odf4/cephcsi-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-cli-rhel9 +3
- RHSA-2024:6122 Released 2025-02-25 · Red Hat rating ImportantOpenShift Container Platform 4.18.1 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/azure-service-rhel9-operator +47
- RHSA-2024:6121 Released 2025-02-25 · Red Hat rating ImportantOpenShift Container Platform 4.18.1 security and extras update
- Red Hat OpenShift Container Platform 4.18 openshift4/ingress-node-firewall-rhel9, openshift4/ingress-node-firewall-rhel9-operator, openshift4/kube-compare-artifacts-rhel9 +47
- RHSA-2025:1249 Released 2025-02-10 · Red Hat rating Importantupdated discovery container images
- Discovery 1 for RHEL 9 discovery/discovery-server-rhel9, discovery/discovery-ui-rhel9
- RHSA-2025:0892 Released 2025-02-03 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.18.0 release
- Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel9, devspaces/dashboard-rhel9, devspaces/devspaces-rhel9-operator +1
- RHSA-2025:0654 Released 2025-01-28 · Red Hat rating ImportantOpenShift Container Platform 4.17.14 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 openshift4/oc-mirror-plugin-rhel9, openshift4/ose-agent-installer-api-server-rhel9, openshift4/ose-baremetal-cluster-api-controllers-rhel9 +6
- RHSA-2024:10908 Released 2024-12-10 · Red Hat rating ModerateRed Hat OpenShift Service Mesh Containers for 2.5.7
- RHOSSM 2.5 for RHEL 8 openshift-service-mesh/kiali-ossmc-rhel8, openshift-service-mesh/kiali-rhel8
- RHSA-2024:10517 Released 2024-12-03 · Red Hat rating ModerateOpenShift Container Platform 4.17.7 security and extras update
- Red Hat OpenShift Container Platform 4.17 openshift4/nmstate-console-plugin-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 3 | Affected | No fix yet: Fix deferred |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet |
| Migration Toolkit for Applications 7 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix planned: Will not fix |
| Node HealthCheck Operator | Affected | No fix planned: Will not fix |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Service Mesh 2 | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Developer Hub 1 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 10 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat Openshift Container Storage 4 | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Trusted Artifact Signer | Affected | No fix yet |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| streams for Apache Kafka | Affected | No fix yet |
| Discovery 1 for RHEL 9 | Fixed | RHSA-2025:1249 |
| RHODF 4.14 for RHEL 9 | Fixed | RHSA-2025:1866 |
| RHODF 4.15 for RHEL 9 | Fixed | RHSA-2025:1865 |
| RHODF 4.16 for RHEL 9 | Fixed | RHSA-2025:1829 |
| RHODF 4.17 for RHEL 9 | Fixed | RHSA-2025:1824 |
| RHODF 4.18 for RHEL 9 | Fixed | RHSA-2025:2652 |
| RHOSSM 2.5 for RHEL 8 | Fixed | RHSA-2024:10908 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2024:10517, RHSA-2025:0654 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2024:6121, RHSA-2024:6122 |
| Red Hat OpenShift Dev Spaces 3 | Fixed | RHSA-2025:0892 |
| Red Hat OpenShift GitOps 1.14 | Fixed | RHSA-2025:3069 |
Not affected: 24 products
- Network Observability Operator
- RHODF 4.14 for RHEL 9
- RHODF 4.15 for RHEL 9
- RHODF 4.16 for RHEL 9
- RHODF 4.17 for RHEL 9
- RHODF 4.18 for RHEL 9
- RHOSSM 2.5 for RHEL 8
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Keycloak
- Red Hat Developer Hub 1
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Data Science (RHODS)
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Spaces 3
- Red Hat Single Sign-On 7
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of OptaPlanner 8
Timeline
- 2026-10-02 Threatist record created from CVE-2023-44270
- 2026-10-03 Alias added: GHSA-7fh5-64p2-3v2j
- 2026-10-27 Affected versions changed · Red Hat
References
Patch 2
More Postcss vulnerabilities
- TI-2026-33367 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments CVSS 3.1CRITICAL 9.1
- TI-2026-48533 Information disclosure in postcss CVSS 4.0MEDIUM 6.3
- TI-2021-06075 Regular expression denial of service (ReDoS) in postcss CVSS 3.1HIGH 7.5
- TI-2021-06061 Regular expression denial of service (ReDoS) in postcss CVSS 3.1MEDIUM 5.3
Sources
- CVE-2023-44270 · CVE Program
- CVE-2023-44270 · NVD
- FIRST EPSS
- GHSA-7fh5-64p2-3v2j · GitHub Advisory Database · CC BY 4.0
- CVE-2023-44270 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences