Log in Start free

Vulnerability · Published Aug 3, 2026 · Assigned by GitHub_M

CVE-2026-69153PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

Medium 6.3

In plain English

A medium-severity path traversal in postcss from postcss. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.5%top 60.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-postcssno fix listedDEBIAN-CVE-2026-69153
Debian:13node-postcssno fix listedDEBIAN-CVE-2026-69153
Debian:14node-postcss8.5.23+~cs10.2.23-1DEBIAN-CVE-2026-69153
Ubuntu:22.04:LTSnode-postcssno fix listedUBUNTU-CVE-2026-69153
Ubuntu:24.04:LTSnode-postcssno fix listedUBUNTU-CVE-2026-69153
Ubuntu:26.04:LTSnode-postcssno fix listedUBUNTU-CVE-2026-69153
Ubuntu:26.10node-postcssno fix listedUBUNTU-CVE-2026-69153
npmpostcss8.5.23GHSA-fxqj-rqcc-2cmp

Affected products (as reported)

VendorProductVersions
postcss postcss < 8.5.19

Weakness: CWE-22, CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References