PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

🗓️ 24 Apr 2026 15:31:42Reported by GitHub Advisory DatabaseType

PostCSS 8.5.5 does not escape </style> in stringified CSS, enabling XSS in HTML style tags.

Reporter	Title	Published	Views	Family All 31
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses postcss-8.4.49.tgz which is vulnerable to CVE-2026-41305	1 Jun 202608:08	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in postcss-8.4.38.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-41305)	1 Jun 202612:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Remediator is affected by mutiple vulnerabilities	27 May 202615:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in postcss-8.5.5.tgz	7 May 202619:52	–	ibm
IBM Security Bulletins	Security Bulletin: Resolved a vulnerability in PostCSS versions prior to 8.5.10	4 May 202609:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules	22 May 202608:50	–	ibm
ATTACKERKB	CVE-2026-41305	24 Apr 202602:27	–	attackerkb
Chainguard	CVE-2026-41305 vulnerabilities	6 May 202619:18	–	cgr
Circl	CVE-2026-41305	20 Apr 202619:34	–	circl
CNNVD	PostCSS 跨站脚本漏洞	24 Apr 202600:00	–	cnnvd

Vulners

Node

postcss postcssRange<8.5.10npm

Source	Link
github	www.github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41305
github	www.github.com/postcss/postcss/releases/tag/8.5.10
github	www.github.com/advisories/GHSA-qx2v-qp2m-jg93

24 Apr 2026 15:31Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.16.1

EPSS0.00011

SSVC