PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

Description

No description available.

Recommendation

Update the postcss package to the latest compatible version. Followings are version details:

• Affected version(s): < 8.5.10
• Patched version(s): 8.5.10

References

• GHSA-qx2v-qp2m-jg93
• CVE-2026-41305
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check - CVE-2026-31860
• Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) - CVE-2026-41321
• Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping - marko - CVE-2026-41591
• Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping - CVE-2026-41591

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

postcss