PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

Description

No description available.

Recommendation

Update the postcss package to the latest compatible version. Followings are version details:

Affected version(s): < 8.5.10
Patched version(s): 8.5.10

References

Could your website be exposed too?

SmartScanner can check your website for PostCSS has XSS via Unescaped </style> in its CSS Stringify Output and gives you actionable findings to investigate.

Start a free scan

Related Issues

Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check - CVE-2026-31860
Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) - CVE-2026-41321
Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping - marko - CVE-2026-41591
Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping - CVE-2026-41591

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

See something that needs correcting? Let us knowUpdated April 24, 2026