Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2026-45623

critical

CVE-2026-45623

postcss: PostCSS: Information disclosure and denial of service via crafted CSS input

Published Modified CWE 22, 200
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GHSA7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high), Red Hat (medium).

Description

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.

Affected packages and fixed versions

SourcePackageFixed in
chainguardarangodb-3.11, arangodb-3.12, authentik-2025.12 and 36 more3.11.14.5-r1 and 33 more
debian 11node-postcssno fix listed
debian 12node-postcssno fix listed
debian 13node-postcssno fix listed
debian 14node-postcss8.5.12+~cs9.3.32-1
echonode-postcssno fix listed
echo npm::Echo OSVpostcss8.5.12
minimoshomepage, kubeflow-pipelines-frontend, langfuse-3 and 4 more2.0.0-r0 and 6 more
npm::GitHub Security Advisory npmpostcss8.5.12
rapidfort alma 10gooseno fix listed
rapidfort alma 9gooseno fix listed
rapidfort debian 12node-postcss0:8.5.12+~cs9.3.32-1
Show all 77 entries from 21 sources
SourcePackageFixed in
chainguardarangodb-3.113.11.14.5-r1
chainguardarangodb-3.123.12.9.4-r22
chainguardauthentik-2025.122025.12.6-r6
chainguardauthentik-2026.22026.2.6-r9
chainguardauthentik-2026.52026.5.6-r4
chainguardauthentik-fips-2026.22026.2.6-r5
chainguardauthentik-fips-2026.52026.5.6-r3
chainguardcadence-web4.0.16-r4
chainguardcommercial-gitlab-rails-ee-19.119.1.7-r3
chainguardcommercial-gitlab-rails-ee-19.219.2.7-r1
chainguardcommercial-gitlab-rails-ee-19.319.3.3-r1
chainguardcommercial-gitlab-rails-ee-19.419.4.1-r1
chainguardcommercial-gitlab-rails-ee-fips-19.119.1.9-r0
chainguardcommercial-gitlab-rails-ee-fips-19.219.2.7-r1
chainguardcommercial-gitlab-rails-ee-fips-19.319.3.3-r1
chainguardcommercial-gitlab-rails-ee-fips-19.419.4.1-r1
chainguardgitlab-rails-ce-18.1118.11.13-r0
chainguardgitlab-rails-ce-19.019.0.10-r0
chainguardgitlab-rails-ce-19.119.1.7-r6
chainguardgitlab-rails-ce-19.219.2.5-r2
chainguardgitlab-rails-ce-19.319.3.1-r6
chainguardgitlab-rails-ce-fips-18.1018.10.8-r8
chainguardgitlab-rails-ce-fips-18.1118.11.12-r2
chainguardgitlab-rails-ce-fips-18.918.9.8-r8
chainguardgitlab-rails-ce-fips-19.019.0.9-r3
chainguardgitlab-rails-ce-fips-19.119.1.7-r3
chainguardgitlab-rails-ce-fips-19.219.2.5-r2
chainguardgitlab-rails-ce-fips-19.319.3.1-r3
chainguardkeep0.54.2-r2
chainguardkeep-fips0.54.2-r3
chainguardlangfuse-33.225.7-r6
chainguardlangfuse-fips-33.224.2-r0
chainguardnextcloud-server-3131.0.14-r6
chainguardnextcloud-server-3333.0.7-r4
chainguardnextcloud-server-3434.0.2-r2
chainguardpelias-api7.8.0-r7
chainguardsemaphore2.18.29-r2
chainguardvitess-2323.0.5-r5
chainguardvitess-2424.0.3-r7
debian 11node-postcssno fix listed
debian 12node-postcssno fix listed
debian 13node-postcssno fix listed
debian 14node-postcss8.5.12+~cs9.3.32-1
echonode-postcssno fix listed
echo npm::Echo OSVpostcss8.5.12
minimoshomepage2.0.0-r0
minimoskubeflow-pipelines-frontend2.17.0-r0
minimoslangfuse-33.224.2-r0
minimosn8n2.36.6-r0
minimosopenclaw2026.4.29-r0
minimostrigger-dev4.5.11-r1
minimosverdaccio6.6.0-r0
npm::GitHub Security Advisory npmpostcss8.5.12
rapidfort alma 10gooseno fix listed
rapidfort alma 9gooseno fix listed
rapidfort debian 12node-postcss0:8.5.12+~cs9.3.32-1
rapidfort debian 13node-postcss0:8.5.12+~cs9.3.32-1
rapidfort fedora 43goose1.45.0-2.fc43
rapidfort Oracle Linux 10gooseno fix listed
rapidfort Oracle Linux 9gooseno fix listed
rapidfort Red Hat 10gooseno fix listed
rapidfort Red Hat 9gooseno fix listed
Red Hatgooseno fix listed
Red Hatnodejs-css-loaderno fix listed
Red Hatnodejs-sanitize-htmlno fix listed
Red Hatopenshift4/ose-consoleno fix listed
Red Hatopenshift4/ose-console-rhel9no fix listed
Red Hatpostcssno fix listed
Red Hatsatellite/iop-advisor-frontend-rhel9no fix listed
Red Hatsatellite/iop-host-inventory-frontend-rhel9no fix listed
Red Hatsatellite/iop-vulnerability-frontend-rhel9no fix listed
seal npm::Seal Security Database@seal-security/postcss7.0.35-sp999, 7.0.39-sp2, 8.3.6-sp999, 8.4.20-sp999, 8.4.30-sp999
seal npm::Seal Security Databasepostcss7.0.35-sp999, 7.0.39-sp2, 8.3.6-sp999, 8.4.20-sp999, 8.4.30-sp999
wolfilangfuse-33.225.7-r6
wolfinextcloud-server-3333.0.7-r4
wolfivitess-2323.0.5-r5
wolfivitess-2424.0.3-r7

References

All 10 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.