Skip to main content

PostCSS CVE-2026-73646

| EUVDEUVD-2026-60239 HIGH
Path Traversal (CWE-22)
2026-08-17 security-advisories@github.com GHSA-r28c-9q8g-f849
Path Traversal Suse
7.5
CVSS 3.1 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
7.5 HIGH

Network vector and no authentication apply only when a service exposes CSS processing externally; confidentiality-only impact reflects read-only .map file disclosure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
Patch available
Aug 17, 2026 - 17:02 EUVD
Source Code Evidence Fetched
Aug 17, 2026 - 16:36 vuln.today
Analysis Generated
Aug 17, 2026 - 16:36 vuln.today
CVE Published
Aug 17, 2026 - 16:17 cve.org
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 21 npm packages depend on postcss (10 direct, 11 indirect)

Ecosystem-wide dependent count for version 8.5.18.

DescriptionCVE.org

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.

AnalysisAI

Path traversal in PostCSS's automatic source map loading allows arbitrary .map file disclosure when untrusted CSS is processed without explicitly opting out. Specifically, lib/previous-map.js constructs file paths from attacker-controlled sourceMappingURL comment values without sandboxing directory traversal sequences, enabling an attacker who can supply CSS to a PostCSS-processing service to exfiltrate sourcesContent from any .map file reachable by the process. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Submit CSS with crafted sourceMappingURL comment
Delivery
PostCSS auto-loads annotation as file path
Exploit
path.join() resolves traversal sequences without sandboxing
Execution
Arbitrary .map file read from filesystem
Persist
sourcesContent merged into result.map
Impact
Attacker retrieves disclosed source content from API response or served artifact
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires all of the following: (1) the target application accepts CSS input from an untrusted source (e.g., user-submitted stylesheets, API endpoints accepting CSS, online CSS tools); (2) the application processes that CSS using PostCSS via `postcss.parse()` or `postcss().process()` without passing `map: false` in the options - the default behavior is to auto-load source maps; (3) the application exposes `result.map` output to the attacker, either by returning it in an API response, writing it to a publicly accessible location, or including it in build artifacts served to the submitting user. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The official CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the network-reachable, unauthenticated nature of exploitation against a service that accepts user CSS, but the real-world risk is contingent on the application architecture. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker submits a CSS payload containing `/*# sourceMappingURL=../../../../var/app/dist/server-bundle.js.map */` to a web service that uses PostCSS to lint or transform user-provided stylesheets, where the service calls `postcss().process(userCss, { from: '/uploads/user/input.css' })` without setting `map: false`. PostCSS reads the traversed `.map` file, merges its `sourcesContent` field - which may contain transpiled server-side JavaScript source code - into `result.map`, and the service writes or returns that output, inadvertently disclosing internal application source to the attacker. …
Remediation Upgrade PostCSS to version 8.5.18 or later, which introduces sandboxing in `loadFile()` using `path.relative()` to ensure resolved `.map` paths remain within the directory of `opts.from`, and rejects absolute or directory-traversing paths by returning `undefined`. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Conduct comprehensive inventory of PostCSS versions 8.0.0-8.5.17 across production, staging, and development environments; disable automatic source map loading in all PostCSS configurations; restrict CSS processing pipelines to accept input only from verified trusted internal sources. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-73646 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy