GHSA-w9m9-85wc-3x92

Source

https://github.com/advisories/GHSA-w9m9-85wc-3x92

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-w9m9-85wc-3x92/GHSA-w9m9-85wc-3x92.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-w9m9-85wc-3x92

Aliases

CVE-2026-9358

Downstream

CGA (104)

MINI (9)

Published

2026-05-26T13:30:30Z

Modified

2026-09-01T16:11:04Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVSS Calculator
2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

postcss-selector-parser allows denial of service through uncontrolled AST recursion

Details

A vulnerability was determined in postcss-selector-parser before 6.1.3 and 7.1.1. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains, that according to his definition "DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS)."

Database specific

{
    "cwe_ids":  [
        "CWE-404"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-01T15:45:53Z",
    "nvd_published_at":  "2026-05-24T06:16:37Z",
    "severity":  "LOW"
}

References

Affected packages

npm / postcss-selector-parser

Package

Name: postcss-selector-parser; View open source insights on deps.dev
Purl: pkg:npm/postcss-selector-parser

Affected ranges

Type: SEMVER
Events: Introduced

6.1.0

Fixed

6.1.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-w9m9-85wc-3x92/GHSA-w9m9-85wc-3x92.json"

npm / postcss-selector-parser

Package

Name: postcss-selector-parser; View open source insights on deps.dev
Purl: pkg:npm/postcss-selector-parser

Affected ranges

Type: SEMVER
Events: Introduced

7.1.0

Fixed

7.1.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-w9m9-85wc-3x92/GHSA-w9m9-85wc-3x92.json"