Information Disclosure Vulnerability in PostCSS by PostCSS

CVE-2026-45623

What is CVE-2026-45623?

An information disclosure vulnerability was identified in PostCSS, where the PreviousMap component improperly handles CSS input. Specifically, when processing CSS strings, it parses the sourceMappingURL comment and dereferences the path without implementing any security checks. This oversight allows attackers to exploit the vulnerability by manipulating the CSS input to read arbitrary files from the host system, potentially leaking sensitive information. The exposed data can be revealed through JSON.parse SyntaxError messages, providing attackers with insights into file existence and potentially facilitating further attacks such as Denial of Service (DoS). This vulnerability impacts any integration that processes untrusted CSS, including CMS themes, user-uploaded styles, and various build pipelines. Users are advised to upgrade to PostCSS version 8.5.12 or later to mitigate the risks.

References