Skip to content

Product

npm color-string vulnerabilities

2 published CVES affecting npm color-string, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
1
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest npm color-string CVEs

Newest publication first

  1. CVE-2025-59142 color-string@2.1.1 contains malware after npm account takeover

    Published
    HighCVSS 8.8 EPSS 0.43%

    color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-string was taken over after a phishing attack. Version 2.1.1 was published, functionally identical to the previous patch version, but with a malware payload add...

  2. CVE-2021-29060 Regular Expression Denial of Service (ReDOS)

    Published
    MediumCVSS 5.3 EPSS 3.1% PoC

    A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.