957 matches found
MAL-2026-12418 Malicious code in postcss-animate-css-vars (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e40aa4b6595789e4ba4b39f82e63526286b36a64ffad2be27536c69c8207590 src/normalize-options.js is heavily obfuscated RC4-decoded string array, hex-numeric literals, rotating string-array shuffler, dead-code comparison...
postcss: PostCSS: Information disclosure via crafted sourceMappingURL
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...
postcss: PostCSS: Information disclosure via path traversal in source map auto-loading
A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted sourceMappingURL values in untrusted CSS files. This allows the attacker to disclose sensitive sourcesContent from arbitrary .map files accessible on the system, leading to informati...
postcss: PostCSS: Information disclosure via crafted sourceMappingURL
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...
MAL-2026-11622 Malicious code in @onereach/postcss-scoped-selector (npm)
npm/@onereach/postcss-scoped-selector is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...
Malicious code in @ornikar/postcss-config (npm)
npm/@ornikar/postcss-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
CLSA-2026-1785204576 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.5-tuxcare.2...
CLSA-2026-1785291205 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 7.0.39-tuxcare.4...
CLSA-2026-1785204444 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.2.13-tuxcare.1...
CLSA-2026-1784943201 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.31-tuxcare.2...
CLSA-2026-1785117457 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.3.6-tuxcare.3...
CLSA-2026-1785117465 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.2.15-tuxcare.2...
CLSA-2026-1784943315 TuxCare security update for postcss (2 CVEs)
TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.4.14-tuxcare.3...
CLSA-2026-1784856189 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.5.6-tuxcare.2...
CLSA-2026-1784856448 TuxCare security update for postcss (1 CVE)
TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.41-tuxcare.3...
CLSA-2026-1779324473 TuxCare security update for postcss (4 CVEs)
TuxCare rebuilt postcss to address 4 CVEs. Fixed in 7.0.32-tuxcare.1...
CLSA-2026-1779670117 TuxCare security update for postcss (4 CVEs)
TuxCare rebuilt postcss to address 4 CVEs. Fixed in 7.0.17-tuxcare.1...
CLSA-2026-1779065188 TuxCare security update for postcss (2 CVEs)
TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.2.15-tuxcare.1...