Css-what Project

Css-what

2 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2022-21222

Exploit
  • EPSS 0.23%
  • Published 30.09.2022 05:15:08
  • Last modified 20.05.2025 16:15:21

The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the pa...

7.5

CVE-2021-33587

  • EPSS 0.21%
  • Published 28.05.2021 20:15:07
  • Last modified 21.11.2024 06:09:08

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.