Detections
Analytics

Echo: postcss-selector-parser: security update to 7.1.6

medium Tenable Cloud Security Plugin ID 473578

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it.
 Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many
 class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs()
 deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays,
 while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these
 passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a
 synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile
 selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an
 exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This
 issue is fixed in version 7.1.6. (CVE-2026-104844)

Solution

Update the postcss-selector-parser library and its related packages to version 7.1.6 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-104844

Plugin Details

Severity: Medium

ID: 473578

Version: Revision 1.1

Type: Local

Published: 10/7/2026

Updated: 10/7/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.65

CVSS v2

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-104844

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/7/2026

Vulnerability Publication Date: 10/2/2026

Reference Information

CVE: CVE-2026-104844