CVE-2026-41305 Details
Description
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.
A cross-site scripting (XSS) vulnerability exists in PostCSS versions prior to 8.5.10. The issue arises because the software does not properly escape '</style>' sequences when converting CSS into an Abstract Syntax Tree (AST) and back. This flaw allows user-submitted CSS containing '</style>' to break out of HTML <style> tags, creating an opportunity for XSS attacks. The vulnerability impacts non-bundler use cases, as most bundlers handle XSS risks independently. To exploit this, a malicious PostCSS plugin could be used to inject harmful code into a website.
Users can upgrade to PostCSS version 8.5.10 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 24, 2026CISA-ADP
Assessed Apr 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/postcss/postcss/releases/tag/8.5.10 | [email protected] | Release NotesVendor |
| https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PostCSS | < 8.5.10 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | New CVE Received | [email protected] |