postcss-selector-parser (npm)
A CSS selector parser, integrates with postcss but does not require it.
Advisories
8
Latest version
7.1.7
Released Oct 20, 2026
License
MIT
OpenSSF Scorecard
5.1 / 10
How to fix
Upgrading to 7.1.6 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install postcss-selector-parser@7.1.7yarn
yarn add postcss-selector-parser@7.1.7pnpm
pnpm add postcss-selector-parser@7.1.7Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-rj75-hqrm-r3gf PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion |
Medium EPSS 0.39% |
< 6.1.5 | 6.1.5 |
| GHSA-rj75-hqrm-r3gf PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion |
Medium EPSS 0.39% |
>= 7.0.0, < 7.1.6 | 7.1.6 |
| GHSA-rj75-hqrm-r3gf PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion |
Medium EPSS 0.39% |
< 6.1.5 | 6.1.5 |
| GHSA-rj75-hqrm-r3gf PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion |
Medium EPSS 0.39% |
>= 7.0.0, < 7.1.6 | 7.1.6 |
| GHSA-w9m9-85wc-3x92 postcss-selector-parser allows denial of service through uncontrolled AST recursion |
Low EPSS 0.33% |
>= 6.1.0, < 6.1.3 | 6.1.3 |
| GHSA-w9m9-85wc-3x92 postcss-selector-parser allows denial of service through uncontrolled AST recursion |
Low EPSS 0.33% |
>= 7.1.0, < 7.1.3 | 7.1.3 |
| GHSA-w9m9-85wc-3x92 postcss-selector-parser allows denial of service through uncontrolled AST recursion |
Low EPSS 0.33% |
>= 6.1.0, < 6.1.3 | 6.1.3 |
| GHSA-w9m9-85wc-3x92 postcss-selector-parser allows denial of service through uncontrolled AST recursion |
Low EPSS 0.33% |
>= 7.1.0, < 7.1.3 | 7.1.3 |
Source: git+https://github.com/postcss/postcss-selector-parser.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor