PostCSS API Vulnerability Exposes Sensitive Data in Affected Versions
CVE-2026-73646

7.5HIGH

Key Information:

Vendor: Postcss
Status: Postcss
Vendor: CVE Published:; 17 August 2026

What is CVE-2026-73646?

A vulnerability in PostCSS allows attacker-controlled values in sourceMappingURL parameters to be processed without proper security measures. This could lead to the unintended disclosure of source content from reachable .map files, compromising sensitive information. The issue has been addressed in version 8.5.18, preventing untrusted CSS processing when not set to map: false.