{"action":"Upgrade css-what to 2.1.3 or later.","affected":[{"fixed":"2.1.3","introduced":"0"}],"component":"css-what","cve_ids":["CVE-2022-21222"],"ecosystem":"npm","epss":0.01904,"exploited":false,"fixed_versions":["2.1.3"],"ghsa_id":"GHSA-p28h-cc7q-c4fg","id":"tcs_01M5KG25G1PBTCB82J5PAK6643","modified_at":"2025-05-20T21:02:33Z","published_at":"2022-10-01T00:00:24Z","references":["https://osv.dev/vulnerability/GHSA-p28h-cc7q-c4fg","https://nvd.nist.gov/vuln/detail/CVE-2022-21222","https://github.com/fb55/css-what/commit/dc510929790da6617e7aa93a616498b22f6a6b72","https://github.com/fb55/css-what","https://github.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.js#23L12","https://github.com/fb55/css-what/blob/a38effd5a8f5506d75c7f8f13cbd8c76248a3860/index.js%23L12","https://lists.debian.org/debian-lts-announce/2023/03/msg00001.html","https://security.snyk.io/vuln/SNYK-JS-CSSWHAT-3035488"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-p28h-cc7q-c4fg","url":"https://osv.dev/vulnerability/GHSA-p28h-cc7q-c4fg"}],"summary":"css-what vulnerable to ReDoS due to use of insecure regular expression"}