What’s Vulnerable › Vulnerabilities

CVE-2020-4070: Cross-site Scripting in CSS Validator

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-06-22 · updated 2026-06-17
• Weakness: CWE-79

Description

In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A user would have to click on a specifically crafted validator link to trigger it. This has been patched in commit e5c09a9.

Affected products

• World Wide Web Consortium (W3C) CSS Validator: through 2020-01-19

References

• https://github.com/w3c/css-validator/commit/e5c09a9119167d3064db786d5f00d730b584a53b
• https://github.com/w3c/css-validator/security/advisories/GHSA-wf36-7w73-rh8c
• https://github.com/w3c/css-validator/commit/e5c09a9119167d3064db786d5f00d730b584a53b
• https://github.com/w3c/css-validator/security/advisories/GHSA-wf36-7w73-rh8c

Get alerted when CVE-2020-4070 or the next vulnerability affects your stack