Description
The fix for GHSA-6g55-p6wh-862q added a guard in lib/previous-map.js PreviousMap.loadFile() that restricts an attacker-controlled sourceMappingURL (from a CSS comment) to a .map extension and, for untrusted maps, rejects .. traversal and absolute paths. The traversal/absolute rejection is nested inside if (cssFile) { ... }.
Recommendation
Update the postcss package to the latest compatible version. Followings are version details:
- Affected version(s): <= 8.5.22
- Patched version(s): 8.5.23
References
Could your website be exposed too?
SmartScanner can check your website for PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `f and gives you actionable findings to investigate.
Start a free scanRelated Issues
- PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments - CVE-2026-45623
- PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure - CVE-2026-73646
- Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) - CVE-2026-45670
- Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) - @nuxt/webpack-builder - CVE-2026-45670
You might also like:
See something that needs correcting? Let us knowUpdated August 03, 2026