PostCSS vulnerabilities

In PostCSS before 8.5.18, loadMap() in lib/previous-map.js passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map.

PostCSS prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application.

PostCSS versions up to 8.5.11 have a vulnerability where the PreviousMap parser reads the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem without scheme, allowlist, or traversal checks. An attacker controlling CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes via a JSON.parse SyntaxError message. The bug also provides a precise file-existence oracle and a controllable-read primitive that can be combined with large files for DoS. The issue is triggered with default PostCSS options and is reachable from any pipeline processing untrusted CSS through PostCSS.