PostCSS CVE-2026-41305

The vulnerability requires that user-submitted or untrusted CSS be parsed by PostCSS and re-stringified for direct embedding in HTML <style> tags without additional escaping or sanitization. Exploitation specifically depends on the application treating PostCSS-stringified output as safe for direct insertion into HTML. If the application already performs HTML entity encoding on stringified CSS output, or restricts CSS parsing to trusted sources, the vulnerability is effectively mitigated. The </style> sequence must appear in a CSS value context (property value, URL, string literal, etc.) rather than as a selector, as that is where parsing leaves it unescaped. Applications that use PostCSS solely for analysis or transformation without re-embedding stringified output in HTML are not at risk. The vulnerability exists in versions before 8.5.10; version 8.5.10 and later properly escape the closing tag sequence.

CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-accessible XSS with low attack complexity, no authentication, and cross-site scope, but requires user interaction (UI:R). The user interaction requirement significantly reduces real-world risk compared to a direct CVSS score might suggest - exploitation requires either a user to submit CSS through an application feature or social engineering to visit a malicious site. No EPSS score, CVSS variant data, or exploitation confirmation (KEV, POC) was provided in the input, so exploitation probability cannot be quantified. However, the attack vector is straightforward: any web application accepting user-submitted CSS and using PostCSS to process it for re-embedding in HTML is vulnerable. The XSS scope is cross-site (S:C), meaning the attacker can affect resources beyond the vulnerable application's immediate context. The fix is available and straightforward (version 8.5.10), reducing exploitation likelihood in patched environments. In unpatched deployments processing untrusted CSS, this represents a real XSS risk, though the UI:R requirement limits it to targeted or social-engineering attacks rather than broad automated exploitation.

A web application allows users to customize website styling by uploading or pasting CSS. An attacker submits CSS containing background-image: url('</style><script>alert("XSS")</script>') or similar payload in a CSS declaration. When the application parses this with PostCSS and re-stringifies it for embedding in an HTML <style> tag, the </style> sequence breaks out of the style context, causing the injected <script> tag to execute in the victim's browser.