Vulnerable Library - jest-dom-5.17.0.tgz
Path to dependency file: /src/diagram-gpt-ui/package.json
Path to vulnerable library: /src/diagram-gpt-ui/node_modules/@adobe/css-tools/package.json
Found in HEAD commit: 285ea721f07fd1565c8cacc444424fe043d3b4b9
Vulnerabilities
| CVE |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (jest-dom version) |
Remediation Possible** |
| CVE-2023-48631 |
 High |
7.5 |
css-tools-4.3.1.tgz |
Transitive |
N/A* |
❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2023-48631
Vulnerable Library - css-tools-4.3.1.tgz
Library home page: https://registry.npmjs.org/@adobe/css-tools/-/css-tools-4.3.1.tgz
Path to dependency file: /src/diagram-gpt-ui/package.json
Path to vulnerable library: /src/diagram-gpt-ui/node_modules/@adobe/css-tools/package.json
Dependency Hierarchy:
- jest-dom-5.17.0.tgz (Root Library)
- ❌ css-tools-4.3.1.tgz (Vulnerable Library)
Found in HEAD commit: 285ea721f07fd1565c8cacc444424fe043d3b4b9
Found in base branch: master
Vulnerability Details
@adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.
Publish Date: 2023-12-14
URL: CVE-2023-48631
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: @adobe/css-tools
Release Date: 2023-12-14
Fix Resolution: @adobe/css-tools - 4.3.2
Step up your Open Source Security Game with Mend here
Path to dependency file: /src/diagram-gpt-ui/package.json
Path to vulnerable library: /src/diagram-gpt-ui/node_modules/@adobe/css-tools/package.json
Found in HEAD commit: 285ea721f07fd1565c8cacc444424fe043d3b4b9
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - css-tools-4.3.1.tgz
Library home page: https://registry.npmjs.org/@adobe/css-tools/-/css-tools-4.3.1.tgz
Path to dependency file: /src/diagram-gpt-ui/package.json
Path to vulnerable library: /src/diagram-gpt-ui/node_modules/@adobe/css-tools/package.json
Dependency Hierarchy:
Found in HEAD commit: 285ea721f07fd1565c8cacc444424fe043d3b4b9
Found in base branch: master
Vulnerability Details
@adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.
Publish Date: 2023-12-14
URL: CVE-2023-48631
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: @adobe/css-tools
Release Date: 2023-12-14
Fix Resolution: @adobe/css-tools - 4.3.2
Step up your Open Source Security Game with Mend here