Log in Start free

postcss

Products

ProductCVEsExploitedLatest
postcss4–Aug 17, 2026
postcss-selector-parser1–Oct 2, 2026

Exploited and recent CVEs

  • CVE-2026-104844 Medium 5.9 PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion 0.4%
  • CVE-2026-73646 High 7.5 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure 0.5%
  • CVE-2026-69153 Medium 6.3 PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset 0.5%
  • CVE-2026-45623 High 7.5 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments 0.6%
  • CVE-2026-41305 Medium 6.1 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output 0.2%