CVE-2026-69153
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
PostCSS prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application.
Risk Assessment
The organization risks leakage of source code or other data contained in source maps, which could be read by an attacker.
Recommendation
Upgrade PostCSS to version 8.5.19 or later, which includes a fix preventing reading unintended source-map files.
Other vulnerabilities in PostCSS
See all- CVE-2026-73646High
In PostCSS before 8.5.18, loadMap() in lib/previous-map.js passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map.
- CVE-2026-45623High
PostCSS versions up to 8.5.11 have a vulnerability where the PreviousMap parser reads the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem without scheme, allowlist, or traversal checks. An attacker controlling CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes via a JSON.parse SyntaxError message. The bug also provides a precise file-existence oracle and a controllable-read primitive that can be combined with large files for DoS. The issue is triggered with default PostCSS options and is reachable from any pipeline processing untrusted CSS through PostCSS.
Original NVD description (English source)
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.