1102 matches found
UBUNTU-CVE-2026-45623
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...
CVE-2026-45623
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...
CVE-2026-45623
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...
EUVD-2026-49376
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...
CVE-2026-45623
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...
CVE-2026-45623
PostCSS vulnerability CVE-2026-45623 affects versions up to 8.5.11. The PreviousMap parses the /*# sourceMappingURL=PATH */ comment from CSS, dereferencing PATH against the local filesystem without scheme, allowlist, or traversal checks. An attacker-controlled CSS input can cause the host process...
CVE-2026-45623 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...
CVE-2026-45623 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...
CVE-2026-45623 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...
CVE-2026-45623: Improper Limitation of a Pathname to a Restricted Directory
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...
Directory Traversal
Overview postcss is a PostCSS is a tool for transforming styles with JS plugins. Affected versions of this package are vulnerable to Directory Traversal via the loadMap process. An attacker can access the contents of arbitrary .map files on the filesystem by submitting crafted CSS containing a...
NPM: PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
NPM: PostCSS: Path Traversal in Previous Source Map Auto-Loading sourceMappingURL leads to Arbitrary .map File Disclosure vulnerability discovered by ? in WordPress Npm postcss versions = 8.5.17...
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
Vulnerability Details File: lib/previous-map.js Line: 87-98 loadFile, 129-144 loadMap Root Cause PostCSS auto-detects a / sourceMappingURL=... / comment inside the CSS text it is asked to parse and, unless the caller explicitly passes map: false, attempts to load that path from disk as a "previou...
GHSA-R28C-9Q8G-F849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
Vulnerability Details File: lib/previous-map.js Line: 87-98 loadFile, 129-144 loadMap Root Cause PostCSS auto-detects a / sourceMappingURL=... / comment inside the CSS text it is asked to parse and, unless the caller explicitly passes map: false, attempts to load that path from disk as a "previou...
Directory Traversal
Overview org.webjars.npm:postcss is a PostCSS is a tool for transforming styles with JS plugins. Affected versions of this package are vulnerable to Directory Traversal via the loadMap process. An attacker can access the contents of arbitrary .map files on the filesystem by submitting crafted CSS...
PT-2026-76686
Name of the Vulnerable Software and Affected Versions PostCSS versions prior to 8.5.18 Description PostCSS transforms CSS files into an Abstract Syntax Tree for analysis and modification. A path traversal issue exists in lib/previous-map.js where the loadMap function passes attacker-controlled...
CVE-2026-45623
creationtimestamp| type| source ---|---|--- 2026-07-23 16:35:02+00:00| published-proof-of-concept| https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q 2026-08-03 18:28:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gp5oyt6frvyqh 2026-08-03 18:31:17+00:00|...
Directory Traversal
Overview postcss is a PostCSS is a tool for transforming styles with JS plugins. Affected versions of this package are vulnerable to Directory Traversal via the process function. An attacker can access arbitrary files and obtain the first 10 bytes of their contents by supplying a crafted...
NPM: PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
NPM: PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments vulnerability discovered by ? in WordPress Npm postcss versions = 8.5.11...
Directory Traversal
Overview org.webjars.npm:postcss is a PostCSS is a tool for transforming styles with JS plugins. Affected versions of this package are vulnerable to Directory Traversal via the process function. An attacker can access arbitrary files and obtain the first 10 bytes of their contents by supplying a...