GHSA-38j3-w94g-v5m4HighCVSS 7.5
CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty...
🔗 CVE IDs covered (1)
📋 Description
CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property names. Attackers can supply a stylesheet with a declaration named length to replace the internal counter and trigger excessive memory allocation during cssText serialization, causing process termination.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-93752
- https://github.com/NV/CSSOM/issues/119
- https://github.com/NV/CSSOM
- https://github.com/NV/CSSOM/blob/00ec21868e12422581c81779135c2f1648441204/lib/CSSStyleDeclaration.js#L112-L124
- https://github.com/NV/CSSOM/blob/00ec21868e12422581c81779135c2f1648441204/lib/CSSStyleDeclaration.js#L41-L56
- https://www.vulncheck.com/advisories/cssom-through-0.5.0-denial-of-service-via-length-property
- https://github.com/advisories/GHSA-38j3-w94g-v5m4