833 matches found
postcss: PostCSS: Information disclosure and denial of service via crafted CSS input
A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifical...
postcss: PostCSS: Information disclosure via crafted sourceMappingURL
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...
ROOT-APP-NPM-CVE-2026-45623 CVE-2026-45623 in postcss - Patched by Root
Root has patched CVE-2026-45623 in the postcss package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-41305 CVE-2026-41305 in postcss - Patched by Root
Root has patched CVE-2026-41305 in the postcss package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-R28C-9Q8G-F849 GHSA-r28c-9q8g-f849 in postcss - Patched by Root
Root has patched GHSA-r28c-9q8g-f849 in the postcss package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2023-44270 CVE-2023-44270 in postcss - Patched by Root
Root has patched CVE-2023-44270 in the postcss package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2021-23382 CVE-2021-23382 in postcss - Patched by Root
Root has patched CVE-2021-23382 in the postcss package for Root:npm. Multiple fixed versions available...
MAL-2026-14261 Malicious code in postcss-initialize-provider (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85729e0f775f02486ef631437f648a1661eced789fa66656248f9d4078ac3f16 [email protected] presents itself as a PostCSS plugin README, badges, and repository links reference the legitimate...
Linux Distros Unpatched Vulnerability : CVE-2026-73646
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18,...
CVE-2026-73646
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...
UBUNTU-CVE-2026-73646
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...
EUVD-2026-60239
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...
CVE-2026-73646 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...
CVE-2026-73646
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...
CVE-2026-73646
Affected component: lib/previous-map.js in PostCSS
CVE-2026-73646 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...
CVE-2026-73646
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...
CVE-2026-73646 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...
PT-2026-76686
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...
