Skip to main content

PostCSS CVE-2026-69153

| EUVDEUVD-2026-52373 MEDIUM
Path Traversal (CWE-22)
2026-08-03 GitHub_M GHSA-fxqj-rqcc-2cmp
Path Traversal Suse Postcss
6.3
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.7 LOW

AC:H reflects the specific deployment condition (from unset) required; C:L for .map-only file disclosure; no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 03, 2026 - 18:02 EUVD
Source Code Evidence Fetched
Aug 03, 2026 - 17:32 vuln.today
Analysis Generated
Aug 03, 2026 - 17:32 vuln.today
CVE Published
Aug 03, 2026 - 16:56 cve.org
MEDIUM 6.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1,330 npm packages depend on postcss (35 direct, 1,295 indirect)

Ecosystem-wide dependent count for version 8.5.23.

DescriptionCVE.org

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.

AnalysisAI

Path traversal in PostCSS npm package (versions through 8.5.22) allows disclosure of arbitrary .map files from the server filesystem when applications process attacker-controlled CSS without the from option. The vulnerability is an incomplete fix bypass of prior advisory GHSA-6g55-p6wh-862q: the traversal guard added to PreviousMap.loadFile() was gated on cssFile being truthy, which is never the case when opts.from is absent. No CISA KEV listing, but a verified proof-of-concept is included in the upstream GHSA advisory GHSA-fxqj-rqcc-2cmp. The CVSS 4.0 score of 6.3 with AT:P correctly reflects the specific deployment condition required.

Technical ContextAI

PostCSS (CPE: cpe:2.3:a:postcss:postcss:*:*:*:*:*:*:*:*) is a widely used Node.js CSS transformation library. When processing CSS, lib/input.js constructs a PreviousMap instance that parses inline `/*

sourceMappingURL=... */ annotations to load external source maps via readFileSync. The prior fix for GHSA-6g55-p6wh-862q added guards in loadFile() rejecting absolute paths and .. traversal sequences - but those checks were nested inside if (cssFile) { ... }, where cssFile is derived from opts.from. When PostCSS is invoked without from (e.g., postcss([]).process(css)), cssFile is undefined, the branch is skipped, and only the .map extension filter remains (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). An attacker embedding /*

sourceMappingURL=/absolute/path/secret.map */ or a ../-traversing relative URL in CSS causes PostCSS to read the target file and expose its sources (filesystem paths) and sourcesContent` fields in the processed output.

RemediationAI

Upgrade PostCSS to version 8.5.23 or later, which contains the complete fix (commit 7beca139e70f9075c6b19700fcb00dd8033e5da8 at https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8). The fix unconditionally returns undefined from loadFile() when cssFile is absent, closing the guard bypass regardless of opts.from. Note: the CVE description cites 8.5.19 as the fix version but this is incorrect for this CVE - 8.5.19 fixed the prior advisory GHSA-6g55-p6wh-862q; treat 8.5.23 as the minimum safe version. Where immediate upgrade is not possible, always pass the from option in every PostCSS invocation: postcss([]).process(css, { from: '/absolute/path/to/source.css' }) - this re-enables the traversal guard as a compensating control. The trade-off is that from must reflect a real trusted path; using a fake path may cause source map resolution to fail silently. Additionally, restrict PostCSS pipelines from accepting untrusted CSS input at the application boundary if feasible.

More in Postcss

View all
CVE-2021-23382 HIGH POC
7.5 Apr 26

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL()

CVE-2021-23368 MEDIUM POC
5.3 Apr 12

The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during s
CVE-2026-9358 LOW POC
2.1 May 24

Uncontrolled recursion in PostCSS up to 7.1.1 allows remote attackers to trigger denial of service via crafted CSS input
CVE-2026-41305 MEDIUM
6.1 Apr 24

PostCSS versions prior to 8.5.10 fail to escape `</style>` sequences when stringifying CSS Abstract Syntax Trees, allowi
CVE-2023-44270 MEDIUM
5.3 Sep 29

An issue was discovered in PostCSS before 8.4.31. Rated medium severity (CVSS 5.3), this vulnerability is remotely explo

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-69153 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy