Skip to content
OpenAdvisories

Vendor

postcss

5 known vulnerabilities.

Products

postcss 4 postcss-selector-parser 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-104844

    PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

    PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters…

    postcss postcss-selector-parser postcss-selector-parser npm
  • Medium 6.3
    CVE-2026-69153

    PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

    PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by suppl…

    postcss postcss node-postcss node-postcss Debian Ubuntu npm
  • Medium 6.1
    CVE-2026-41305

    PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

    PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and …

    postcss postcss node-postcss node-postcss Debian Ubuntu npm