Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses postcss-selector-parser-7.1.1.tgz which is vulnerable to CVE-2026-9358

Summary IBM Maximo Application Suite - Visual Inspection component uses postcss-selector-parser-7.1.1.tgz which is vulnerable to CVE-2026-9358, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-9358 DESCRIPTION: A vulnerabilit...

MAL-2026-10687 Malicious code in selparsecss-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4f8e230628f3622bf88bcd590f98f8065a99ea3e71ef1bf3c330439b7671e1f [email protected] is a name-confusion fork of postcss-selector-parser: package.json declares author 'Ai Pyramid' while the LICENSE-MIT, sour...

MAL-2026-5737 Malicious code in postcss-minify-selector-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957f5cbb74f4dd4b4770e8c9cc1a8aac88a4450cb01dbc0fa5242c42e343f54c The package name impersonates the widely-used postcss-selector-parser library which it also declares as a dependency and re-exports verbatim from...

postcss-selector-parser: Postcss: Denial of Service via uncontrolled recursion in AST Serialization

A flaw was found in postcss. A remote attacker could exploit a vulnerability in the toString function of the AST Serialization component by executing a manipulation, leading to uncontrolled recursion. This uncontrolled recursion can result in a Denial of Service DoS condition, making the affected...

@1stg/app-config (>=10.0.0, <=15.0.0), @1stg/common-config (>=10.0.0, <=15.0.0) +373 more potentially affected by CVE-2026-9358 via postcss-selector-parser (>=7.1.0, <=7.1.2)

postcss-selector-parser NPM version =7.1.0, =10.0.0, =10.0.0, =8.1.0, =13.0.0, =0.1.0-dev25004766367, =0.7.0-rohit-magnitude-valuetext.1, =1.0.3, =1.11.1, =1.11.1, =1.11.1, =1.12.0, =1.11.1, =1.11.1, =1.11.1, =1.11.1, =1.19.0 and more Source cves: CVE-2026-9358 Source advisory:...

GHSA-W9M9-85WC-3X92 postcss-selector-parser allows denial of service through uncontrolled AST recursion

A vulnerability was determined in postcss-selector-parser before 6.1.3 and 7.1.1. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely...

@ahnlabcloudmate/design-system (>=0.0.1-beta.0, <=0.2526.3), @azu/eslint-plugin-panda-oxc (>=1.0.1, <=1.0.2) +223 more potentially affected by CVE-2026-9358 via postcss-selector-parser (>=6.1.0, <=6.1.2)

postcss-selector-parser NPM version =6.1.0, =0.0.1-beta.0, =1.0.1, =0.0.3, =0.0.1, =0.0.1, =0.0.1, =0.0.4, =0.0.3, =0.0.3, =0.0.1, =0.0.1, =0.0.9, =0.0.1, =0.0.4, =0.0.32 and more Source cves: CVE-2026-9358 Source advisory: OSV:GHSA-W9M9-85WC-3X92...

postcss-selector-parser allows denial of service through uncontrolled AST recursion

A vulnerability was determined in postcss-selector-parser before 6.1.3 and 7.1.1. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via the toString function in the AST Serialization. An attacker can cause uncontrolled recursion by providing specially crafted input, potentially resulting in resource exhaustion and application unavailability...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via the toString function in the AST Serialization. An attacker can cause uncontrolled recursion by providing specially crafted input, potentially resulting in resource exhaustion and application unavailability...

org.webjars.npm:coreui__coreui (4.2.1), org.webjars.npm:css-loader (>=2.1.0, <=6.7.2) +19 more potentially affected by CVE-2026-9358 via org.webjars.npm:postcss-selector-parser (>=4.0.0-rc.1, <=7.1.0)

org.webjars.npm:postcss-selector-parser MAVEN version =4.0.0-rc.1, =2.1.0, =3.1.0, =7.0.1, =4.0.2, =2.0.6, =2.1.0, =4.1.2, =6.2.0 and more Source cves: CVE-2026-9358 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16873883...

UBUNTU-CVE-2026-9358

A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The...

CVE-2026-9358

A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The...

CVE-2026-9358 postcss-selector-parser AST Serialization container.js toString recursion

A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The...