CVE-2026-73646
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
In PostCSS before 8.5.18, loadMap() in lib/previous-map.js passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map.
Risk Assessment
Processing untrusted CSS could lead to disclosure of source content from .map files, potentially compromising data confidentiality.
Recommendation
Update PostCSS to version 8.5.18 or later, and avoid processing untrusted CSS without setting map: false.
Other vulnerabilities in PostCSS
See all- CVE-2026-69153Medium
PostCSS prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application.
- CVE-2026-45623High
PostCSS versions up to 8.5.11 have a vulnerability where the PreviousMap parser reads the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem without scheme, allowlist, or traversal checks. An attacker controlling CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes via a JSON.parse SyntaxError message. The bug also provides a precise file-existence oracle and a controllable-read primitive that can be combined with large files for DoS. The issue is triggered with default PostCSS options and is reachable from any pipeline processing untrusted CSS through PostCSS.
Original NVD description (English source)
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS