postcss-selector-parser up to 6.1.2/7.1.2 AST Serialization container.js toString recursion

Summaryinfo

A vulnerability was found in postcss-selector-parser up to 6.1.2/7.1.2. It has been classified as problematic. Affected by this vulnerability is the function toString of the file src/selectors/container.js of the component AST Serialization. The manipulation leads to recursion. This vulnerability is documented as CVE-2026-9358. The attack can be initiated remotely. Additionally, an exploit exists. Upgrading the affected component is recommended. The vendor explains, that according to his definition "DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS)." The commits were backported to 6.x branch, which was the most downloaded version.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in postcss-selector-parser up to 6.1.2/7.1.2. This issue affects the function toString of the file src/selectors/container.js of the component AST Serialization. The manipulation with an unknown input leads to a recursion vulnerability. Using CWE to declare the problem leads to CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. Impacted is availability.

The advisory is shared at gist.github.com. The identification of this vulnerability is CVE-2026-9358. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The exploit is available at gist.github.com. It is declared as proof-of-concept. The vendor explains, that according to his definition "DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS)." The commits were backported to 6.x branch, which was the most downloaded version. The vulnerability scanner Nessus provides a plugin with the ID 318727 (Linux Distros Unpatched Vulnerability : CVE-2026-9358), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.1.3 or 7.1.3 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5bc698cef66f8abd12610dc623e5d67cbc0f869d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (318727) and EUVD (EUVD-2026-31571). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• postcss-selector-parser

Version

• 6.1.0
• 6.1.1
• 6.1.2
• 7.1.0
• 7.1.1
• 7.1.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #813080: postcss-selector-parser postcss <= 7.1.1 CWE-674: Uncontrolled Recursion (by bx33661)

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion