Skip to content
OpenAdvisories

Vendor

postcss

5 known vulnerabilities.

Products

postcss 4 postcss-selector-parser 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-73646

    PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

    PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), …

    postcss postcss node-postcss node-postcss Debian Ubuntu npm
  • High 7.5
    CVE-2026-45623

    PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

    PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to pr…

    postcss postcss node-postcss node-postcss Debian Ubuntu npm