CVE-2026-45623 in PostCSS
Summary
by MITRE • 07/27/2026
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
PostCSS serves as a powerful tool for processing and transforming CSS files through its Abstract Syntax Tree API, enabling developers to analyze and modify CSS rules programmatically. The vulnerability exists within the PreviousMap functionality that handles source map comments, specifically the /# sourceMappingURL=PATH / directive parsing mechanism. This flaw affects versions 8.5.11 and earlier where the system fails to properly validate or sanitize file paths contained within these comments during the CSS processing pipeline.
The technical implementation of this vulnerability stems from improper path resolution logic that treats any provided PATH value as a direct filesystem reference without any form of validation or sanitization. When PostCSS encounters a sourceMappingURL comment, it attempts to dereference the specified path against the local filesystem using no scheme validation, whitelist restrictions, or traversal prevention mechanisms. This creates a critical security gap where arbitrary file system access becomes possible through crafted CSS input containing malicious source map references.
The operational impact of this vulnerability extends far beyond simple information disclosure, as attackers can leverage it to perform precise file existence checks and read the first approximately 10 bytes of any file accessible to the Node.js process. This capability enables attackers to construct detailed reconnaissance maps of the target system's filesystem structure while simultaneously gaining access to sensitive data that might be embedded within configuration files or other resources. The vulnerability's reach is particularly concerning because it operates under PostCSS's default processing conditions, requiring no special configuration parameters such as from, map, or plugin options.
The attack surface encompasses numerous legitimate use cases where untrusted CSS input flows through PostCSS processing pipelines, including content management systems accepting user-generated themes, browser extensions processing user stylesheets, build systems handling third-party package styling, and comment rendering engines in blogging platforms. This broad applicability means that the vulnerability could be exploited across multiple attack vectors without requiring specialized conditions or configurations. The DoS potential increases significantly when combined with large file targets, as the system's response time can be manipulated to consume excessive resources through controlled read operations.
Security professionals should note this vulnerability aligns with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-73 (External Control of File Name or Path) categories, representing classic path traversal and file inclusion security flaws. The ATT&CK framework categorizes this issue under T1059.006 (Command and Scripting Interpreter: PowerShell) and potentially T1068 (Exploitation for Privilege Escalation) depending on the target system's configuration. Remediation requires updating to PostCSS version 8.5.12 or later, which implements proper path validation and sanitization mechanisms. Organizations should also consider implementing additional input validation layers in their processing pipelines as defense-in-depth measures while monitoring for potential exploitation attempts through their logging and monitoring systems.