@adobe/css-tools Improper Input Validation and Inefficient Regular Expression Complexity

[AvramLavinia]

ENVIRONMENT: PROD

• url: https://github.com/peviitor-ro/search-engine/security/dependabot/48
• browser: Chrome
• issues on building process

STEPS TO REPRODUCE:

1. open github REPOSITORY
2. go to Security tab
3. click on Dependabot
4. check for Moderate security incidents (@adobe/css-tools)

EXPECTED RESULTS: No security incidents

ACTUAL RESULTS: @adobe/css-tools version 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.

Recommended steps to fix this issue: 1.Update the Package: npm install @adobe/css-tools@4.3.2 2.Verify the Update: npm list @adobe/css-tools

P.S: your @adobe/css-tools version is 4.3.1, update it to 4.3.2. Maybe the code will need some change too after this update.

[sebiboga]

this was fixed