CVE-2026-41305
published 2026-04-24CVE-2026-41305: PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10…
PriorityP430medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.21%
10.7th percentile
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `` tags, `` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.
Affected
69 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | system-rhel7 | — | — |
| 3scale-amp2 | system-rhel8 | — | — |
| 3scale-amp2 | system-rhel9 | — | — |
| 3scale-amp21 | system | — | — |
| 3scale-amp22 | system | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform | automation-portal | — | — |
| apicurio | apicurio-registry-ui-rhel8 | — | — |
| apicurio | apicurio-registry-ui-rhel9 | — | — |
| clusterlabs | pcs | — | — |
| container-native-virtualization | kubevirt-console-plugin-rhel9 | — | — |
| devspaces | dashboard-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| discovery | discovery-ui-rhel9 | — | — |
| gatekeeper | gatekeeper-rhel9 | — | — |
| grafana | grafana | — | — |
| mozilla | firefox | — | — |
| mozilla | thunderbird | — | — |
| multicluster-engine | console-mce-rhel9 | — | — |
| network-observability | network-observability-console-plugin-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel8 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel8 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
postcss up to 8.5.9 CSS File cross site scripting (GHSA-qx2v-qp2m-jg93 / Nessus ID 310276)
vuldb·2026-05-23·CVSS 6.1
CVE-2026-41305 [MEDIUM] postcss up to 8.5.9 CSS File cross site scripting (GHSA-qx2v-qp2m-jg93 / Nessus ID 310276)
A vulnerability, which was classified as problematic, has been found in postcss up to 8.5.9. The affected element is an unknown function of the component CSS File Handler. The manipulation leads to cross site scripting.
This vulnerability is referenced as CVE-2026-41305. Remote exploitation of the attack is possible. No exploit is available.
It is advisable to upgrade the affected component.
GHSA
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
ghsa·2026-04-24
CVE-2026-41305 [MEDIUM] CWE-79 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
PostCSS has XSS via Unescaped in its CSS Stringify Output
# PostCSS: XSS via Unescaped `` in CSS Stringify Output
## Summary
PostCSS v8.5.5 (latest) does not escape `` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `` tags, `` in CSS values breaks out of the style context, enabling XSS.
## Proof of Concept
```javascript
const postcss = require('postcss');
// Parse user CSS and re-stringify for page embedding
const userCSS = 'body { content: "alert(1)"; }';
const ast = postcss.parse(userCSS);
const output = ast.toResult().css;
const html = `${output}`;
console.log(html);
// body { content: "alert(1)"; }
//
// Browser: closes the style tag, executes
```
**Tested output** (Node.js v22, postcss v8.5.5):
```
Input: body {
Red Hat
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags
vendor_redhat·2026-04-24·CVSS 6.1
CVE-2026-41305 [MEDIUM] CWE-79 postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags
postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags
A flaw was found in PostCSS. This vulnerability allows a remote attacker to perform Cross-Site Scripting (XSS) by submitting specially crafted CSS. When PostCSS processes and re-stringifies this CSS for embedding within HTML `` tags, it fails to properly escape `` sequences. This oversight enables the injected `` to prematurely close the HTML style block, allowing the attacker to inject malicious scripts and execute arbitrary code in the user's browser context.
Package: cryostat-openshift-console-plugin-npm (Cryostat 4) - Fix deferred
Package: postcss (Cryostat 4) - Fix deferred
Package: gatekeeper/gatekeeper-rhel9 (Gatekeeper 3) - Fix deferred
Package: rhmtc/openshift-migration-ui-rhel8 (Migratio
No detection rules found.
No public exploits indexed.
2026-04-24
Published