958 matches found
CVE-2026-41305
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML tags, in CSS...
CVE-2026-41305
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML tags, in CSS...
PostCSS 跨站脚本漏洞
PostCSS is an open-source style transformation tool developed by PostCSS. Versions of PostCSS prior to 8.5.10 contained a cross-site scripting vulnerability. This vulnerability stemmed from the lack of escaping of the sequence during CSS stringification using the CSS AST. As a result, when the...
CVE-2026-41305: Improper Neutralization of Input During Web Page Generation
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML in CSS value...
Malicious code in postcss-hotfix (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5b4d8ad8f9c133d2d8680b4d666d442b455bbd1579dea5cd5582a883fc4f0b5 The package postcss-hotfix was found to contain malicious code...
MAL-2026-1822 Malicious code in postcss-hotfix (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5b4d8ad8f9c133d2d8680b4d666d442b455bbd1579dea5cd5582a883fc4f0b5 The package postcss-hotfix was found to contain malicious code...
org.webjars.npm:cssnano (5.1.14), org.webjars.npm:cssnano-preset-default (5.2.13) +2 more potentially affected by CVE-2026-29074 via org.webjars.npm:svgo (2.8.0)
org.webjars.npm:svgo MAVEN version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:svgo and may be impacted: - org.webjars.npm:cssnano 5.1.14 - org.webjars.npm:cssnano-preset-default 5.2.13 - org.webjars.npm:esbuild-plugin-svg 0.1...
Security Bulletin: IBM watsonx Orchestrate Developer Edition is vulnerable to Improper Input Validation due to postcss
Summary postcss is used by IBM watsonx Orchestrate Developer Edition as part of wxo-chat Vulnerability Details CVEID:CVE-2023-44270 DESCRIPTION: An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepa...
Security Bulletin: Vulnerabilities in Eran Hammer cryptiles, PostCSS,Node.js,node-notifier,es5-ext ,MySQL Connectors,json-path and tough-cookie might affect IBM Storage Defender Copy Data Management
Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Eran Hammer cryptiles, PostCSS,Node.js,node-notifier,es5-ext ,MySQL Connectors,json-path and tough-cookier. Vulnerabilities include an attacker is able to brute force something that was supposed to be random, ...
EUVD-2025-175857
Malicious code in typeorm-postcss-process-biomimicry npm...
EUVD-2025-177799
Malicious code in miranda-postcss-blitz-module npm...
EUVD-2025-177641
Malicious code in nestjs-postcss-loader-slides-spinner npm...
EUVD-2025-178480
Malicious code in hydra-markdown-pdf-resolvers-postcss npm...
EUVD-2025-177090
Malicious code in postcss-mongodb-astrometry-eslint-config npm...
MAL-2025-188783 Malicious code in postcss-loader-prosthetics-loopback-javascript (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f9f63b6e2e1816f62d699a65d1f5b8c88dc6d76c09ded78c5dca4dcc42d958 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179276
Malicious code in dorado-hexo-sqlite-postcss-loader npm...
EUVD-2025-176921
Malicious code in publish-postcss-loader-achernar-hermes npm...
EUVD-2025-176890
Malicious code in puppeteer-tailwindcss-karma-postcss npm...
Malicious code in puppeteer-tailwindcss-karma-postcss (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d9679267623f6c6b49f81c8f19e9f271e992336207668f965e6348a4c9bbf98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...