PostCSS EUVD-2026-31571

Exploitation requires server-side PostCSS deployment that processes untrusted user-generated CSS input. The vulnerability does NOT affect standard PostCSS usage in developer build pipelines (webpack, Rollup, Parcel) where developers control CSS sources. Specific vulnerable scenarios include: platforms accepting custom CSS theme uploads for server-side compilation, CSS validation/linting APIs processing arbitrary user submissions, automated build systems pulling and processing CSS from untrusted external repositories, or SaaS applications allowing customers to inject custom stylesheets compiled on the backend. The UI:R CVSS component indicates user interaction is required, meaning the attacker must induce the target system or user to process the malicious CSS through PostCSS-direct remote code execution against passive servers is not possible. Additionally, the target must run PostCSS versions <=7.1.1, as later versions may have architectural changes preventing the recursion. The 'low risk' vendor assessment stems from the rarity of production systems processing untrusted CSS server-side, which limits real-world attack surface compared to theoretical CVSS scoring.

Real-world risk is MODERATE despite the 4.3 CVSS Base Score. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-accessible exploitation with low complexity but requires user interaction, limiting automated mass exploitation. The UI:R (user interaction required) component significantly constrains attack scenarios-an attacker must induce a victim to process malicious CSS through PostCSS, which typically occurs in developer toolchains rather than production runtime. Publicly available exploit code (E:P in temporal metrics) lowers the barrier to exploitation for targeted attacks. However, the vendor's risk assessment highlights a critical constraint: PostCSS is predominantly used in build-time CSS compilation where developers control input sources, NOT for processing untrusted user-generated CSS at runtime. Exploitation scenarios are thus limited to platforms accepting arbitrary CSS uploads for server-side processing (custom CSS themes, CSS validation services, automated build systems processing external stylesheets). The 'Information Disclosure' tag in the input data appears misapplied-CWE-674 and A:L impact indicate availability disruption, not confidentiality breach. No EPSS score provided, but KEV status is absent, confirming no evidence of widespread active exploitation. SSVC decision: exploitation requires specific server-side CSS processing workflows uncommon in standard web applications, making this automatable:no, technical_impact:partial (temporary DoS).

An attacker crafts a malicious CSS file with deeply nested or recursive selector structures designed to trigger infinite recursion in PostCSS's AST serialization. They submit this CSS to a web application offering custom theme uploads or CSS validation services that process user-provided stylesheets server-side using vulnerable PostCSS versions. When the server invokes PostCSS toString on the malicious AST, the recursion exhausts stack memory, crashing the Node.js worker process and temporarily disrupting the CSS processing service. Public exploit code available at https://gist.github.com/bx33661/581e3a38134601c04e19b4dfc9b459b9 demonstrates the attack payload structure.