EUVD-2026-60239

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...

CVE-2026-73646

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...

CVE-2026-73646

Affected component: lib/previous-map.js in PostCSS

CVE-2026-73646

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...

CVE-2026-73646 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...

CVE-2026-73646 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...

CVE-2026-73646: Improper Limitation of a Pathname to a Restricted Directory

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...

CVE-2026-73646

creationtimestamp| type| source ---|---|--- 2026-08-13 18:35:05+00:00| published-proof-of-concept| https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849...

Malicious code in postcss-initialize-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c75b316d71a07c70e033fe47d5a3efbd6c3dbccb3b1ae8466a4d325c0d1ada79 postcss-initialize-plugin is a typosquat of postcss-initial. Its README, repository URL, and author metadata are copied verbatim from...

postcss: PostCSS: Information disclosure via path traversal in source map auto-loading

A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted sourceMappingURL values in untrusted CSS files. This allows the attacker to disclose sensitive sourcesContent from arbitrary .map files accessible on the system, leading to informati...

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

CLSA-2026-1786374683 TuxCare security update for postcss (1 CVE)

TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.3.6-tuxcare.4...

Malicious code in postcss-initial-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e88db5eb44ddcfa3cd22d46e8b6e6a1cd2e7da25a5942d35550d50f2cbbb9ea3 index.js contains a unicode-escape-obfuscated block that runs when the package is required. It queries public Ethereum RPC endpoints 1rpc.io/eth,...

MAL-2026-13696 Malicious code in postcss-initial-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e88db5eb44ddcfa3cd22d46e8b6e6a1cd2e7da25a5942d35550d50f2cbbb9ea3 index.js contains a unicode-escape-obfuscated block that runs when the package is required. It queries public Ethereum RPC endpoints 1rpc.io/eth,...

MAL-2026-13518 Malicious code in postcss-theme-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d6afcada49b5397e1b4d6a41d4ec0b31903593e65219c919e0d310d3941a40 packages/core/src/index.ts and plugin.ts compiled into dist/index.cjs referenced by main contain a top-level async IIFE that executes on require of t...

Malicious code in postcss-theme-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d6afcada49b5397e1b4d6a41d4ec0b31903593e65219c919e0d310d3941a40 packages/core/src/index.ts and plugin.ts compiled into dist/index.cjs referenced by main contain a top-level async IIFE that executes on require of t...

Information Disclosure postcss Dependency in Confluence Data Center

This High severity Information Disclosure vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Information Disclosure vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

Malicious code in post-css-transfer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f62ccc235772a34a28d870f349489698c167e3d636a196f310fe24c1ce1d4ef4 post-css-transfer is a typosquat of postcss whose main entry lib/postcss.js has an obfuscated IIFE appended after the legitimate module code. On...

MAL-2026-12417 Malicious code in post-css-transfer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f62ccc235772a34a28d870f349489698c167e3d636a196f310fe24c1ce1d4ef4 post-css-transfer is a typosquat of postcss whose main entry lib/postcss.js has an obfuscated IIFE appended after the legitimate module code. On...