Vulnerability record · CVE-2022-21222 · published 30 September 2022
CVE-2022-21222: Css-what project css-what inefficient regular expression (redos) vulnerability
CCss What Project · Css What
The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.
Description
The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.js%23L12 | Broken LinkThird Party Advisory |
| https://lists.debian.org/debian-lts-announce/2023/03/msg00001.html | |
| https://security.snyk.io/vuln/SNYK-JS-CSSWHAT-3035488 | ExploitThird Party Advisory |
| https://github.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.js%23L12 | Broken LinkThird Party Advisory |
| https://lists.debian.org/debian-lts-announce/2023/03/msg00001.html | |
| https://security.snyk.io/vuln/SNYK-JS-CSSWHAT-3035488 | ExploitThird Party Advisory |
Track CVE-2022-21222 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-21222), CISA KEV, FIRST EPSS (scores of 2026-10-05). This page is refreshed as NVD updates the record.
