5 ms·

> biting a lot of people In what sense? I doubt there are many apps (if any) out there that actually have a vulnerability here, because it's unlikely that a w

> biting a lot of people In what sense? I doubt there are many apps (if any) out there that actually have a vulnerability here, because it's unlikely that a web app out there is going to be passing random user input to a mac address package.

evan_ 8y ago
Add to that that cssnano is unlikely to even be present in deployed code, it’s a build tool.
- bpicolo 8y ago
  cssnano doesn't even use the package directly, doubt you could find a path where it passes any cssnano calls down to it