PostCSS CVE-2026-73646

Exploitation requires all of the following: (1) the target application accepts CSS input from an untrusted source (e.g., user-submitted stylesheets, API endpoints accepting CSS, online CSS tools); (2) the application processes that CSS using PostCSS via postcss.parse() or postcss().process() without passing map: false in the options - the default behavior is to auto-load source maps; (3) the application exposes result.map output to the attacker, either by returning it in an API response, writing it to a publicly accessible location, or including it in build artifacts served to the submitting user. Exploitation is limited by: the file disclosure is restricted to files with a .map extension (a prior patch in 8.5.12 removed the ability to read arbitrary extensions); the PostCSS process must have filesystem read permissions on the target .map file; and if opts.from is set (standard practice), the attacker must use relative ../ traversal sequences rather than absolute paths. Applications that set map: false, strip sourceMappingURL comments from input, or never expose result.map to callers are not exploitable.

The official CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the network-reachable, unauthenticated nature of exploitation against a service that accepts user CSS, but the real-world risk is contingent on the application architecture. Exploitation requires three conditions to be simultaneously true: the service must accept attacker-supplied CSS, process it with PostCSS without setting map: false, and expose result.map output to the attacker. Services that internally validate, discard, or never expose result.map are not vulnerable in practice. No EPSS score was provided in the input data and KEV status is not confirmed, indicating this has not been observed in widespread active exploitation campaigns. The absence of a KEV listing and POC means this is best treated as a high-priority library update rather than an emergency incident response trigger, though any build pipeline, CSS-as-a-service endpoint, or design tool that processes user-provided stylesheets should treat patching as urgent given the low exploitation complexity once the conditions are met.

An attacker submits a CSS payload containing `/*

sourceMappingURL=../../../../var/app/dist/server-bundle.js.map */ to a web service that uses PostCSS to lint or transform user-provided stylesheets, where the service calls postcss().process(userCss, { from: '/uploads/user/input.css' }) without setting map: false. PostCSS reads the traversed .map file, merges its sourcesContent field - which may contain transpiled server-side JavaScript source code - into result.map`, and the service writes or returns that output, inadvertently disclosing internal application source to the attacker. No publicly available exploit code has been confirmed at time of analysis, but the GHSA advisory provides sufficient implementation detail for a competent attacker to reproduce the technique.