-
-
Notifications
You must be signed in to change notification settings - Fork 72
Closed
Description
Bug report
using this plugin will result in Expression Denial of Service in postcss from @types/stylelint
Actual Behavior
Expression Denial of Service in postcss - GHSA-566m-qj78-rww5
Expected Behavior
no denial of service
How Do We Reproduce?
just use styleint-webpack-plugin
and you'll get the audit report
postcss <8.2.13
Severity: moderate
Regular Expression Denial of Service in postcss - https://github.com/advisories/GHSA-566m-qj78-rww5
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/@types/stylelint/node_modules/postcss
node_modules/postcss-filter-plugins/node_modules/postcss
node_modules/postcss-icss-keyframes/node_modules/postcss
node_modules/postcss-icss-selectors/node_modules/postcss
@types/stylelint 9.10.0 - 13.13.3
Depends on vulnerable versions of postcss
node_modules/@types/stylelint
stylelint-webpack-plugin >=2.2.0
Depends on vulnerable versions of @types/stylelint
node_modules/stylelint-webpack-plugin
icss-utils <=4.1.1
Depends on vulnerable versions of postcss
node_modules/postcss-icss-keyframes/node_modules/icss-utils
node_modules/postcss-filter-plugins
typescript-plugin-css-modules *
Depends on vulnerable versions of postcss-filter-plugins
Depends on vulnerable versions of postcss-icss-keyframes
Depends on vulnerable versions of postcss-icss-selectors
node_modules/typescript-plugin-css-modules
postcss-icss-keyframes *
Depends on vulnerable versions of postcss
node_modules/postcss-icss-keyframes
postcss-icss-selectors *
Depends on vulnerable versions of postcss
node_modules/postcss-icss-selectors
8 moderate severity vulnerabilities
Metadata
Metadata
Assignees
Labels
No labels