CVE-2023-26364

5.3 mediumEPSS 1.2%

Medium (5.3) in adobe css-tools. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in @adobe/css-tools 4.3.1.

@adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a minor denial of service while attempting to parse CSS. Exploitation of this issue does not require user interaction or privileges.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2023-11-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

adobe:css-tools

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-hpx4-r86g-5jrg	npm	@adobe/css-tools	<4.3.1	4.3.1

References

https://github.com/adobe/css-tools/security/advisories/GHSA-hpx4-r86g-5jrg
https://github.com/adobe/css-tools/security/advisories/GHSA-hpx4-r86g-5jrg

Check your stack JSON