{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9358", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-05-23T09:49:26.559Z", "datePublished": "2026-05-24T05:30:09.671Z", "dateUpdated": "2026-05-24T05:30:09.671Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-24T05:30:09.671Z"}, "title": "postcss AST Serialization container.js toString recursion", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-674", "lang": "en", "description": "Uncontrolled Recursion"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-404", "lang": "en", "description": "Denial of Service"}]}], "affected": [{"vendor": "n/a", "product": "postcss", "versions": [{"version": "7.1.0", "status": "affected"}, {"version": "7.1.1", "status": "affected"}], "cpes": ["cpe:2.3:a:postcss:postcss:*:*:*:*:*:*:*:*"], "modules": ["AST Serialization"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in postcss up to 7.1.1. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains, that according to his definition \"DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS).\""}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-05-23T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-05-23T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-05-23T11:54:49.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "bx33661 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/365321", "name": "VDB-365321 | postcss AST Serialization container.js toString recursion", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/365321/cti", "name": "VDB-365321 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/813080", "name": "Submit #813080 | postcss-selector-parser postcss <= 7.1.1 CWE-674: Uncontrolled Recursion", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/bx33661/581e3a38134601c04e19b4dfc9b459b9", "tags": ["exploit"]}]}}}

{}

{}

{}