PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

Description

PostCSS’s PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check.

Recommendation

Update the postcss package to the latest compatible version. Followings are version details:

• Affected version(s): <= 8.5.11
• Patched version(s): 8.5.12

References

• GHSA-6g55-p6wh-862q
• CVE-2026-45623
• CWE-200
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `f - CVE-2026-69153
• @babel/core: Arbitrary File Read via sourceMappingURL Comment - CVE-2026-49356
• PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure - CVE-2026-73646
• Prompty: Arbitrary file read via file reference expansion - CVE-2026-53598

You might also like:

Exploiting Server Version Disclosure

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

postcss