Lucene search
+L

4 matches found

OSV
OSV
•added 2026/04/24 3:31 p.m.•22 views

GHSA-QX2V-QP2M-JG93 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

PostCSS: XSS via Unescaped in CSS Stringify Output Summary PostCSS v8.5.5 latest does not escape sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML tags, in CSS values breaks out of the style context, enabling XSS. Proof of Concept...

6.1CVSS5.3AI score0.00263EPSS
SaveExploits0References4
Rows per page
Query Builder