The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: snyk

Published: 2022-09-30T05:05:11.059417Z

Updated: 2024-09-17T00:31:50.814Z

Reserved: 2022-02-24T00:00:00

Link: CVE-2022-21222

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-09-30T05:15:08.713

Modified: 2024-11-21T06:44:08.667

Link: CVE-2022-21222

cve-icon Redhat

Severity : Moderate

Publid Date: 2022-09-30T00:00:00Z

Links: CVE-2022-21222 - Bugzilla