A link to the CVE: https://nvd.nist.gov/vuln/detail/CVE-2023-44270

react-scripts@5.0.1 requires postcss@^7.0.35 via a transitive dependency on resolve-url-loader@4.0.0

I see the latest version of resolve-url-loader is 5.x, and it depends on postcss@8.x. So can we update resolve-url-loader to a non-vulnerable version? Thank you!

Actually, in our project, we don't import the resolve-url-loader package directly. Only react-scripts module has some dependencies with resolve-url-loader and here I get vulnerabilities.
So in this case, how can I address them?
Do I have to change the version of react-scripts or just need to install proper version of resolve-url-loader separately?

I had to use overrides in my package.json to overcome there errors:

  "overrides": {
    "nth-check": "https://registry.npmjs.org/nth-check/-/nth-check-2.1.1.tgz",
    "postcss": "https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz"
  }

However the dependency should be updated in the main branch

@Dror-Bar thank you, you are going to be in my video on using Trivy to fix vulnerabilities with this suggestion -- Thank you!!!