XSS Vulnerability in PostCSS API for CSS File Analysis and Modification
CVE-2026-41305

6.1MEDIUM

Key Information:

Vendor

Postcss

Status
Postcss
Vendor
CVE Published:
24 April 2026

What is CVE-2026-41305?

PostCSS, a popular CSS processing tool, has a vulnerability in versions before 8.5.10 that exposes users to Cross-Site Scripting (XSS) attacks. The flaw occurs due to improper escaping of </style> sequences when re-stringifying CSS Abstract Syntax Trees (ASTs) for insertion into HTML <style> tags. Malicious CSS inputs can exploit this weakness, allowing attackers to execute harmful scripts within the context of a user’s browser. Users are urged to update to version 8.5.10 or later to mitigate this risk.

Affected Version(s)

postcss < 8.5.10

References

https://github.com/postcss/postcss/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/postcss/postcss/releases/tag/8.5.10
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.