CVE-2026-78594

Improper Handling of Highly Compressed Data CWE-409 in APM Server can lead to a persistent denial of service via Excessive Allocation CAPEC-130. An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory availabl...

CVE-2026-78594 Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service

Improper Handling of Highly Compressed Data CWE-409 in APM Server can lead to a persistent denial of service via Excessive Allocation CAPEC-130. An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory availabl...

CVE-2026-78594 Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service

Improper Handling of Highly Compressed Data CWE-409 in APM Server can lead to a persistent denial of service via Excessive Allocation CAPEC-130. An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts the memory availabl...

postcss: PostCSS: Information disclosure via path traversal in source map auto-loading

A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted sourceMappingURL values in untrusted CSS files. This allows the attacker to disclose sensitive sourcesContent from arbitrary .map files accessible on the system, leading to informati...

postcss: PostCSS: Information disclosure via path traversal in source map auto-loading

A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted sourceMappingURL values in untrusted CSS files. This allows the attacker to disclose sensitive sourcesContent from arbitrary .map files accessible on the system, leading to informati...

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

CVE-2026-69153

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

Directory Traversal

Overview postcss is a PostCSS is a tool for transforming styles with JS plugins. Affected versions of this package are vulnerable to Directory Traversal in the PreviousMap.loadFile method of lib/previous-map.js, which nests its traversal guard inside an if cssFile branch that is skipped when the...

EUVD-2026-52373

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...

CVE-2026-69153

CVE-2026-69153 (PostCSS) affects PostCSS prior to 8.5.19. If the option from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL, exposing the map’s sources and sourcesContent. The issue is f...

CVE-2026-69153

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...

CVE-2026-69153 PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...

CVE-2026-69153 PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...

PT-2026-67450

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...

Linux Distros Unpatched Vulnerability : CVE-2026-69153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is...

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

Vulnerability Details File: lib/previous-map.js Line: 87-98 loadFile, 129-144 loadMap Root Cause PostCSS auto-detects a / sourceMappingURL=... / comment inside the CSS text it is asked to parse and, unless the caller explicitly passes map: false, attempts to load that path from disk as a "previou...

CVE-2026-49356

A flaw was found in @babel/core. This vulnerability allows an attacker, who controls the input source code and can read the output, to perform an arbitrary file read. By compiling maliciously crafted code containing a sourceMappingURL comment, the attacker can read any source map file from the...

@babel/core: Arbitrary File Read via sourceMappingURL Comment

Impact Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true: - the attacker controls the input source code - the attacker can read the output source code - the attacker knows the...

PT-2026-49556

Name of the Vulnerable Software and Affected Versions @babel/core versions prior to 7.29.6 @babel/core versions prior to 8.0.0-rc.6 Description Compiling maliciously crafted code using @babel/core can allow an attacker to read any source map from the system. This occurs when the attacker controls...

EUVD-2026-19875

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the...