search

microsoft / spfx-react-webchat

Modern sharepoint online webpart to integrate the BotFramework webchat
MIT License
10 stars 4 forks source link

PKG:NPM/POSTCSS@7.0.35 #40

Open domacKA opened 1 year ago

domacKA commented 1 year ago

Package: postcss Version: 7.0.35 Description: Tool for transforming styles with JS plugins

The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing. Sonatype's research suggests that this CVE's details differ from those defined at NVD.

CVSS Score: 5.3

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/*\s sourceMappingURL=(.).

CVSS Score: 7.5

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

1 non-CVE vulnerability found.

CVSS Score: 6.5

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H