CVE-2021-23382 @ Npm-postcss-6.0.23

[Svetlana-github]

Vulnerable Package issue exists @ Npm-postcss-6.0.23 in branch main

The package postcss before 7.0.36 and in 8.x before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

Namespace: Svetlana-github
Repository: test
Repository Url: https://github.com/Svetlana-github/test
CxAST-Project: Svetlana-github/test
CxAST platform scan: 8821ba41-d324-41fa-8053-d13dfc156a43
Branch: main
Application: test
Severity: MEDIUM
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-400

---

Addition Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: NONE
Availability impact: LOW
Remediation Upgrade Recommendation: 7.0.36

---

References
Advisory
Commit
Pull request
Commit