PostCSS CVE-2026-69153

Exploitation requires all of the following to be true simultaneously: (1) the application passes attacker-controlled CSS content to PostCSS for processing - the malicious `/*

sourceMappingURL= */ comment value must be under attacker influence; (2) PostCSS is invoked without the from option (opts.from is undefined, null, or absent), causing cssFile to be falsy and skipping the traversal guard; (3) opts.map is not set to false - if it is, PreviousMap returns early before reaching loadFile(); and (4) the target .map file exists on the server filesystem and contains valid JSON. Exploitation is limited to files with a .map extension - the remaining extension check blocks all other file types. Applications that always provide opts.from, explicitly set opts.map: false`, or never expose PostCSS processing of untrusted input are not exploitable.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N) is consistent with the vulnerability mechanics: unauthenticated network access is required to deliver the malicious CSS, but AT:P flags the specific deployment condition (absence of opts.from) that must hold. Impact is bounded to low confidentiality - only files with a .map extension are readable, limiting the worst-case disclosure to source map files that may contain original source paths and content. No EPSS data is available in the provided intelligence. The existence of a verified PoC (demonstrated against v8.5.22 in GHSA-fxqj-rqcc-2cmp) meaningfully elevates practical risk above what the score alone suggests, particularly for applications that build CSS transformation pipelines from user-supplied input without consistently setting from. The absence of CISA KEV listing suggests no observed mass exploitation at time of analysis. The incomplete-fix nature of this CVE warrants expedited patching for any organization that applied the GHSA-6g55-p6wh-862q fix and assumed the issue was closed.

An attacker submits a crafted CSS string containing `/*

sourceMappingURL=/var/app/config/secrets.map */ to a web application that accepts user CSS and processes it via postcss([]).process(userInput) without a from option. PostCSS reads the specified file from the server filesystem, and the sources and sourcesContent` fields of the parsed source map are returned in the processed result or passed to downstream application logic, disclosing the file's contents to the attacker. A verified PoC confirming this exact scenario against PostCSS 8.5.22 is included in the GHSA-fxqj-rqcc-2cmp advisory.