CVE-2023-44270

CVE-2023-44270 is a medium-severity vulnerability affecting PostCSS versions prior to 8.4.31, specifically impacting linters that parse untrusted external CSS. An attacker can craft CSS to embed malicious code within comments, which PostCSS incorrectly processes and includes in its output as active CSS nodes. The vulnerability has a CVSS score of 5.3, indicating a network-based attack with low complexity, requiring no user interaction, and resulting in a low impact on integrity. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.