Attestkeep
Sprache: Deutsch
Loslegen

Schwachstellen / CVE-2026-45623

kritisch

CVE-2026-45623

postcss: PostCSS: Information disclosure and denial of service via crafted CSS input

Veröffentlicht Geändert CWE 22, 200
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.

Einstufung nach Quelle

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GHSA7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut GHSA (hoch), Red Hat (mittel).

Beschreibung

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.

Betroffene Pakete und behobene Versionen

QuellePaketBehoben in
chainguardarangodb-3.11, arangodb-3.12, authentik-2025.12 und 36 weitere3.11.14.5-r1 und 33 weitere
debian 11node-postcsskein Fix angegeben
debian 12node-postcsskein Fix angegeben
debian 13node-postcsskein Fix angegeben
debian 14node-postcss8.5.12+~cs9.3.32-1
echonode-postcsskein Fix angegeben
echo npm::Echo OSVpostcss8.5.12
minimoshomepage, kubeflow-pipelines-frontend, langfuse-3 und 4 weitere2.0.0-r0 und 6 weitere
npm::GitHub Security Advisory npmpostcss8.5.12
rapidfort alma 10goosekein Fix angegeben
rapidfort alma 9goosekein Fix angegeben
rapidfort debian 12node-postcss0:8.5.12+~cs9.3.32-1
Alle 77 Einträge aus 21 Quellen zeigen
QuellePaketBehoben in
chainguardarangodb-3.113.11.14.5-r1
chainguardarangodb-3.123.12.9.4-r22
chainguardauthentik-2025.122025.12.6-r6
chainguardauthentik-2026.22026.2.6-r9
chainguardauthentik-2026.52026.5.6-r4
chainguardauthentik-fips-2026.22026.2.6-r5
chainguardauthentik-fips-2026.52026.5.6-r3
chainguardcadence-web4.0.16-r4
chainguardcommercial-gitlab-rails-ee-19.119.1.7-r3
chainguardcommercial-gitlab-rails-ee-19.219.2.7-r1
chainguardcommercial-gitlab-rails-ee-19.319.3.3-r1
chainguardcommercial-gitlab-rails-ee-19.419.4.1-r1
chainguardcommercial-gitlab-rails-ee-fips-19.119.1.9-r0
chainguardcommercial-gitlab-rails-ee-fips-19.219.2.7-r1
chainguardcommercial-gitlab-rails-ee-fips-19.319.3.3-r1
chainguardcommercial-gitlab-rails-ee-fips-19.419.4.1-r1
chainguardgitlab-rails-ce-18.1118.11.13-r0
chainguardgitlab-rails-ce-19.019.0.10-r0
chainguardgitlab-rails-ce-19.119.1.7-r6
chainguardgitlab-rails-ce-19.219.2.5-r2
chainguardgitlab-rails-ce-19.319.3.1-r6
chainguardgitlab-rails-ce-fips-18.1018.10.8-r8
chainguardgitlab-rails-ce-fips-18.1118.11.12-r2
chainguardgitlab-rails-ce-fips-18.918.9.8-r8
chainguardgitlab-rails-ce-fips-19.019.0.9-r3
chainguardgitlab-rails-ce-fips-19.119.1.7-r3
chainguardgitlab-rails-ce-fips-19.219.2.5-r2
chainguardgitlab-rails-ce-fips-19.319.3.1-r3
chainguardkeep0.54.2-r2
chainguardkeep-fips0.54.2-r3
chainguardlangfuse-33.225.7-r6
chainguardlangfuse-fips-33.224.2-r0
chainguardnextcloud-server-3131.0.14-r6
chainguardnextcloud-server-3333.0.7-r4
chainguardnextcloud-server-3434.0.2-r2
chainguardpelias-api7.8.0-r7
chainguardsemaphore2.18.29-r2
chainguardvitess-2323.0.5-r5
chainguardvitess-2424.0.3-r7
debian 11node-postcsskein Fix angegeben
debian 12node-postcsskein Fix angegeben
debian 13node-postcsskein Fix angegeben
debian 14node-postcss8.5.12+~cs9.3.32-1
echonode-postcsskein Fix angegeben
echo npm::Echo OSVpostcss8.5.12
minimoshomepage2.0.0-r0
minimoskubeflow-pipelines-frontend2.17.0-r0
minimoslangfuse-33.224.2-r0
minimosn8n2.36.6-r0
minimosopenclaw2026.4.29-r0
minimostrigger-dev4.5.11-r1
minimosverdaccio6.6.0-r0
npm::GitHub Security Advisory npmpostcss8.5.12
rapidfort alma 10goosekein Fix angegeben
rapidfort alma 9goosekein Fix angegeben
rapidfort debian 12node-postcss0:8.5.12+~cs9.3.32-1
rapidfort debian 13node-postcss0:8.5.12+~cs9.3.32-1
rapidfort fedora 43goose1.45.0-2.fc43
rapidfort Oracle Linux 10goosekein Fix angegeben
rapidfort Oracle Linux 9goosekein Fix angegeben
rapidfort Red Hat 10goosekein Fix angegeben
rapidfort Red Hat 9goosekein Fix angegeben
Red Hatgoosekein Fix angegeben
Red Hatnodejs-css-loaderkein Fix angegeben
Red Hatnodejs-sanitize-htmlkein Fix angegeben
Red Hatopenshift4/ose-consolekein Fix angegeben
Red Hatopenshift4/ose-console-rhel9kein Fix angegeben
Red Hatpostcsskein Fix angegeben
Red Hatsatellite/iop-advisor-frontend-rhel9kein Fix angegeben
Red Hatsatellite/iop-host-inventory-frontend-rhel9kein Fix angegeben
Red Hatsatellite/iop-vulnerability-frontend-rhel9kein Fix angegeben
seal npm::Seal Security Database@seal-security/postcss7.0.35-sp999, 7.0.39-sp2, 8.3.6-sp999, 8.4.20-sp999, 8.4.30-sp999
seal npm::Seal Security Databasepostcss7.0.35-sp999, 7.0.39-sp2, 8.3.6-sp999, 8.4.20-sp999, 8.4.30-sp999
wolfilangfuse-33.225.7-r6
wolfinextcloud-server-3333.0.7-r4
wolfivitess-2323.0.5-r5
wolfivitess-2424.0.3-r7

Referenzen

Alle 10 Referenzen

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.