CVE-2026-45623
postcss: PostCSS: Information disclosure and denial of service via crafted CSS input
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: GHSA (yüksek), Red Hat (orta).
Açıklama
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| chainguard | arangodb-3.11, arangodb-3.12, authentik-2025.12 ve 36 tane daha | 3.11.14.5-r1 ve 33 tane daha |
| debian 11 | node-postcss | düzeltme belirtilmemiş |
| debian 12 | node-postcss | düzeltme belirtilmemiş |
| debian 13 | node-postcss | düzeltme belirtilmemiş |
| debian 14 | node-postcss | 8.5.12+~cs9.3.32-1 |
| echo | node-postcss | düzeltme belirtilmemiş |
| echo npm::Echo OSV | postcss | 8.5.12 |
| minimos | homepage, kubeflow-pipelines-frontend, langfuse-3 ve 4 tane daha | 2.0.0-r0 ve 6 tane daha |
| npm::GitHub Security Advisory npm | postcss | 8.5.12 |
| rapidfort alma 10 | goose | düzeltme belirtilmemiş |
| rapidfort alma 9 | goose | düzeltme belirtilmemiş |
| rapidfort debian 12 | node-postcss | 0:8.5.12+~cs9.3.32-1 |
21 kaynaktaki 77 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| chainguard | arangodb-3.11 | 3.11.14.5-r1 |
| chainguard | arangodb-3.12 | 3.12.9.4-r22 |
| chainguard | authentik-2025.12 | 2025.12.6-r6 |
| chainguard | authentik-2026.2 | 2026.2.6-r9 |
| chainguard | authentik-2026.5 | 2026.5.6-r4 |
| chainguard | authentik-fips-2026.2 | 2026.2.6-r5 |
| chainguard | authentik-fips-2026.5 | 2026.5.6-r3 |
| chainguard | cadence-web | 4.0.16-r4 |
| chainguard | commercial-gitlab-rails-ee-19.1 | 19.1.7-r3 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 19.2.7-r1 |
| chainguard | commercial-gitlab-rails-ee-19.3 | 19.3.3-r1 |
| chainguard | commercial-gitlab-rails-ee-19.4 | 19.4.1-r1 |
| chainguard | commercial-gitlab-rails-ee-fips-19.1 | 19.1.9-r0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 19.2.7-r1 |
| chainguard | commercial-gitlab-rails-ee-fips-19.3 | 19.3.3-r1 |
| chainguard | commercial-gitlab-rails-ee-fips-19.4 | 19.4.1-r1 |
| chainguard | gitlab-rails-ce-18.11 | 18.11.13-r0 |
| chainguard | gitlab-rails-ce-19.0 | 19.0.10-r0 |
| chainguard | gitlab-rails-ce-19.1 | 19.1.7-r6 |
| chainguard | gitlab-rails-ce-19.2 | 19.2.5-r2 |
| chainguard | gitlab-rails-ce-19.3 | 19.3.1-r6 |
| chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r3 |
| chainguard | gitlab-rails-ce-fips-19.1 | 19.1.7-r3 |
| chainguard | gitlab-rails-ce-fips-19.2 | 19.2.5-r2 |
| chainguard | gitlab-rails-ce-fips-19.3 | 19.3.1-r3 |
| chainguard | keep | 0.54.2-r2 |
| chainguard | keep-fips | 0.54.2-r3 |
| chainguard | langfuse-3 | 3.225.7-r6 |
| chainguard | langfuse-fips-3 | 3.224.2-r0 |
| chainguard | nextcloud-server-31 | 31.0.14-r6 |
| chainguard | nextcloud-server-33 | 33.0.7-r4 |
| chainguard | nextcloud-server-34 | 34.0.2-r2 |
| chainguard | pelias-api | 7.8.0-r7 |
| chainguard | semaphore | 2.18.29-r2 |
| chainguard | vitess-23 | 23.0.5-r5 |
| chainguard | vitess-24 | 24.0.3-r7 |
| debian 11 | node-postcss | düzeltme belirtilmemiş |
| debian 12 | node-postcss | düzeltme belirtilmemiş |
| debian 13 | node-postcss | düzeltme belirtilmemiş |
| debian 14 | node-postcss | 8.5.12+~cs9.3.32-1 |
| echo | node-postcss | düzeltme belirtilmemiş |
| echo npm::Echo OSV | postcss | 8.5.12 |
| minimos | homepage | 2.0.0-r0 |
| minimos | kubeflow-pipelines-frontend | 2.17.0-r0 |
| minimos | langfuse-3 | 3.224.2-r0 |
| minimos | n8n | 2.36.6-r0 |
| minimos | openclaw | 2026.4.29-r0 |
| minimos | trigger-dev | 4.5.11-r1 |
| minimos | verdaccio | 6.6.0-r0 |
| npm::GitHub Security Advisory npm | postcss | 8.5.12 |
| rapidfort alma 10 | goose | düzeltme belirtilmemiş |
| rapidfort alma 9 | goose | düzeltme belirtilmemiş |
| rapidfort debian 12 | node-postcss | 0:8.5.12+~cs9.3.32-1 |
| rapidfort debian 13 | node-postcss | 0:8.5.12+~cs9.3.32-1 |
| rapidfort fedora 43 | goose | 1.45.0-2.fc43 |
| rapidfort Oracle Linux 10 | goose | düzeltme belirtilmemiş |
| rapidfort Oracle Linux 9 | goose | düzeltme belirtilmemiş |
| rapidfort Red Hat 10 | goose | düzeltme belirtilmemiş |
| rapidfort Red Hat 9 | goose | düzeltme belirtilmemiş |
| Red Hat | goose | düzeltme belirtilmemiş |
| Red Hat | nodejs-css-loader | düzeltme belirtilmemiş |
| Red Hat | nodejs-sanitize-html | düzeltme belirtilmemiş |
| Red Hat | openshift4/ose-console | düzeltme belirtilmemiş |
| Red Hat | openshift4/ose-console-rhel9 | düzeltme belirtilmemiş |
| Red Hat | postcss | düzeltme belirtilmemiş |
| Red Hat | satellite/iop-advisor-frontend-rhel9 | düzeltme belirtilmemiş |
| Red Hat | satellite/iop-host-inventory-frontend-rhel9 | düzeltme belirtilmemiş |
| Red Hat | satellite/iop-vulnerability-frontend-rhel9 | düzeltme belirtilmemiş |
| seal npm::Seal Security Database | @seal-security/postcss | 7.0.35-sp999, 7.0.39-sp2, 8.3.6-sp999, 8.4.20-sp999, 8.4.30-sp999 |
| seal npm::Seal Security Database | postcss | 7.0.35-sp999, 7.0.39-sp2, 8.3.6-sp999, 8.4.20-sp999, 8.4.30-sp999 |
| wolfi | langfuse-3 | 3.225.7-r6 |
| wolfi | nextcloud-server-33 | 33.0.7-r4 |
| wolfi | vitess-23 | 23.0.5-r5 |
| wolfi | vitess-24 | 24.0.3-r7 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2026-45623
- https://advisory.echohq.com/cve/CVE-2026-45623
- https://github.com/advisories/GHSA-6g55-p6wh-862q
- https://github.com/postcss/postcss
- https://github.com/postcss/postcss/commit/aaec7b78b3ce2792585b4b300ef1bd5dd5b3e8ad
- https://github.com/postcss/postcss/commit/c64b7488d2731dfa16213739b42c34faf5a9eba3
- https://github.com/postcss/postcss/releases/tag/8.5.12
- https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q