Vulnerable Library - autoprefixer-9.8.6.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Found in HEAD commit: 1e5781423c543a0c9bfedb4c5a57ca049920974b
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-41305
Vulnerable Library - postcss-7.0.35.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- autoprefixer-9.8.6.tgz (Root Library)
- ❌ postcss-7.0.35.tgz (Vulnerable Library)
Found in HEAD commit: 1e5781423c543a0c9bfedb4c5a57ca049920974b
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape "</style>" sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML "<style>" tags, "</style>" in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.
Publish Date: 2026-04-24
URL: CVE-2026-41305
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.205%
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-qx2v-qp2m-jg93
Release Date: 2026-04-24
Fix Resolution (postcss): 8.5.10
Direct dependency fix Resolution (autoprefixer): 10.0.0
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2023-44270
Vulnerable Library - postcss-7.0.35.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- autoprefixer-9.8.6.tgz (Root Library)
- ❌ postcss-7.0.35.tgz (Vulnerable Library)
Found in HEAD commit: 1e5781423c543a0c9bfedb4c5a57ca049920974b
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.
Publish Date: 2023-09-29
URL: CVE-2023-44270
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.822%
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-7fh5-64p2-3v2j
Release Date: 2023-09-29
Fix Resolution (postcss): 8.4.31
Direct dependency fix Resolution (autoprefixer): 10.0.0
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2021-23382
Vulnerable Library - postcss-7.0.35.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- autoprefixer-9.8.6.tgz (Root Library)
- ❌ postcss-7.0.35.tgz (Vulnerable Library)
Found in HEAD commit: 1e5781423c543a0c9bfedb4c5a57ca049920974b
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /\s sourceMappingURL=(.*).
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2021-04-26
URL: CVE-2021-23382
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 2.508%
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382
Release Date: 2021-04-26
Fix Resolution (postcss): 7.0.36
Direct dependency fix Resolution (autoprefixer): 9.8.7
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2021-23368
Vulnerable Library - postcss-7.0.35.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- autoprefixer-9.8.6.tgz (Root Library)
- ❌ postcss-7.0.35.tgz (Vulnerable Library)
Found in HEAD commit: 1e5781423c543a0c9bfedb4c5a57ca049920974b
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
Publish Date: 2021-04-12
URL: CVE-2021-23368
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 3.54%
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23368
Release Date: 2021-04-12
Fix Resolution (postcss): 7.0.36
Direct dependency fix Resolution (autoprefixer): 9.8.7
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2021-23364
Vulnerable Library - browserslist-4.16.1.tgz
Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset
Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.16.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- autoprefixer-9.8.6.tgz (Root Library)
- ❌ browserslist-4.16.1.tgz (Vulnerable Library)
Found in HEAD commit: 1e5781423c543a0c9bfedb4c5a57ca049920974b
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
Publish Date: 2021-04-28
URL: CVE-2021-23364
Threat Assessment
Exploit Maturity: Proof of concept
EPSS: 2.429%
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23364
Release Date: 2021-04-28
Fix Resolution (browserslist): 4.16.5
Direct dependency fix Resolution (autoprefixer): 9.8.7
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Found in HEAD commit: 1e5781423c543a0c9bfedb4c5a57ca049920974b
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - postcss-7.0.35.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 1e5781423c543a0c9bfedb4c5a57ca049920974b
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape "</style>" sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML "<style>" tags, "</style>" in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.
Publish Date: 2026-04-24
URL: CVE-2026-41305
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.205%
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-qx2v-qp2m-jg93
Release Date: 2026-04-24
Fix Resolution (postcss): 8.5.10
Direct dependency fix Resolution (autoprefixer): 10.0.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - postcss-7.0.35.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 1e5781423c543a0c9bfedb4c5a57ca049920974b
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.
Publish Date: 2023-09-29
URL: CVE-2023-44270
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.822%
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-7fh5-64p2-3v2j
Release Date: 2023-09-29
Fix Resolution (postcss): 8.4.31
Direct dependency fix Resolution (autoprefixer): 10.0.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - postcss-7.0.35.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 1e5781423c543a0c9bfedb4c5a57ca049920974b
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /\s sourceMappingURL=(.*).
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2021-04-26
URL: CVE-2021-23382
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 2.508%
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382
Release Date: 2021-04-26
Fix Resolution (postcss): 7.0.36
Direct dependency fix Resolution (autoprefixer): 9.8.7
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - postcss-7.0.35.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 1e5781423c543a0c9bfedb4c5a57ca049920974b
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
Publish Date: 2021-04-12
URL: CVE-2021-23368
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 3.54%
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23368
Release Date: 2021-04-12
Fix Resolution (postcss): 7.0.36
Direct dependency fix Resolution (autoprefixer): 9.8.7
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - browserslist-4.16.1.tgz
Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset
Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.16.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: 1e5781423c543a0c9bfedb4c5a57ca049920974b
Found in base branch: main
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
Publish Date: 2021-04-28
URL: CVE-2021-23364
Threat Assessment
Exploit Maturity: Proof of concept
EPSS: 2.429%
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23364
Release Date: 2021-04-28
Fix Resolution (browserslist): 4.16.5
Direct dependency fix Resolution (autoprefixer): 9.8.7
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.