Description
@adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a minor denial of service while attempting to parse CSS. Exploitation of this issue does not require user interaction or privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Adobe | Not a product | ≤ 4.3.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.5 | cockpit-wicked | 5~git8.c06c55b-150500.3.3.1 | SUSE-SU-2024:1415-2, SUSE-SU-2024:1415-1 |
| SLE Micro 5.4 | cockpit-wicked | 4.5-150400.3.3.1 | SUSE-SU-2024:1416-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @adobe/css-tools | < 4.3.1 | 4.3.1 | GHSA-hpx4-r86g-5jrg |
Advisories 4
- WID-SEC-2024-1226 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 11, 2026
- SUSE-SU-2024:1415-2 Security update for cockpit-wicked SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1415-1 Security update for cockpit-wicked SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1416-1 Security update for cockpit-wicked SUSE / openSUSE Security Updates · Feb 4, 2026