CVE-2026-45623 Details
Description
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.
A vulnerability in PostCSS in versions through 8.5.11 allows for arbitrary file reading. The issue arises in the PreviousMap component, which processes source mapping URLs from CSS comments without proper validation. An attacker can exploit this by injecting a path to a file readable by Node, causing the host process to leak the first approximately 10 bytes of the file's content via a JSON parsing error. This vulnerability also acts as a file-existence oracle and can be exploited to read large files, potentially leading to a denial-of-service condition.
Users are advised to update PostCSS to version 8.5.12 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| postcss postcss | < 8.5.12 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | Initial Analysis | [email protected] |
| Jul 27, 2026 | New CVE Received | [email protected] |
| Jul 27, 2026 | CVE Modified | CISA-ADP |