CVE-2026-69153 Details
Description
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
A vulnerability in PostCSS prior to version 8.5.19 allows for arbitrary source map files to be read and their contents exposed. This issue arises when the 'from' option is not set, enabling an attacker to manipulate the sourceMappingURL to reference unintended .map files, including those outside the project directory. The vulnerability exploits the PreviousMap.loadFile() function, which, under certain conditions, reads the specified source map file and discloses its sources and sourcesContent to the application. The issue is particularly concerning for applications that process attacker-controlled CSS without a specified 'from' option, as it can lead to the leakage of sensitive information from the file system.
Users should update to PostCSS version 8.5.23 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8 | [email protected] | Patch |
| https://github.com/postcss/postcss/releases/tag/8.5.19 | [email protected] | ProductRelease Notes |
| https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| postcss postcss | < 8.5.23 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |