CVE-2026-45623
published 2026-07-27CVE-2026-45623: PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and…
PriorityP356critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.61%
48.0th percentile
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.
Affected
70 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | system-rhel7 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-27 | gateway-rhel9 | — | — |
| ansible-automation-platform | automation-portal | — | — |
| apicurio | apicurio-registry-ui-rhel8 | — | — |
| clusterlabs | pcs | — | — |
| container-native-virtualization | kubevirt-console-plugin-rhel9 | — | — |
| devspaces | code-rhel9 | — | — |
| devspaces | dashboard-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| discovery | discovery-ui-rhel9 | — | — |
| external-secrets-management | console-plugin-rhel9 | — | — |
| gatekeeper | gatekeeper-rhel9 | — | — |
| grafana | grafana | — | — |
| mozilla | firefox | — | — |
| mozilla | thunderbird | — | — |
| multicluster-engine | console-mce-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
| openshift-lightspeed | lightspeed-agentic-console-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-419-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-pf5-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-pf5-rhel9 | — | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
PostCSS up to 8.5.11 PreviousMap process path traversal (WID-SEC-2026-2923)
vuldb·2026-08-20·CVSS 9.1
CVE-2026-45623 [CRITICAL] PostCSS up to 8.5.11 PreviousMap process path traversal (WID-SEC-2026-2923)
A vulnerability, which was classified as critical, has been found in PostCSS up to 8.5.11. This affects the function process of the component PreviousMap. Performing a manipulation results in path traversal.
This vulnerability is reported as CVE-2026-45623. The attack is possible to be carried out remotely. No exploit exists.
It is advisable to upgrade the affected component.
GHSA
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
ghsa·2026-07-23
CVE-2026-45623 [HIGH] CWE-200 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
## Summary
PostCSS's `PreviousMap` parses the `/*# sourceMappingURL=PATH */` comment from any CSS string passed to `process()` and dereferences `PATH` against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting `JSON.parse` `SyntaxError` message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no `from`, no `map`, no plugins required — and is theref
Red Hat
postcss: PostCSS: Information disclosure and denial of service via crafted CSS input
vendor_redhat·2026-07-27·CVSS 7.5
CVE-2026-45623 [HIGH] CWE-22 postcss: PostCSS: Information disclosure and denial of service via crafted CSS input
postcss: PostCSS: Information disclosure and denial of service via crafted CSS input
A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifically the first few bytes of file content. Additionally, this vulnerability may be exploited to cause a Denial of Service (DoS) by targeting large files, making the system unavailable.
Package: cryostat-openshift-console-plugin-npm (Cryostat 4) - Affected
Package: grafana-infinity-datasource-npm (Cryostat 4) - Affected
Package: postcss (Cryostat 4) - Affected
Package: gatekeeper/gatekeeper-rhel9 (Gatekeeper 3) -
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-45623 python-jupytext: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 python-jupytext: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 python-jupytext: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file reada
Bugzilla
CVE-2026-45623 cachelib: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 cachelib: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 cachelib: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by
Bugzilla
CVE-2026-45623 mozjs128: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 mozjs128: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 mozjs128: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by
Bugzilla
CVE-2026-45623 qt5-qtwebengine: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 qt5-qtwebengine: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 qt5-qtwebengine: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file reada
Bugzilla
CVE-2026-45623 fbthrift: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 fbthrift: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 fbthrift: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by
Bugzilla
CVE-2026-45623 seamonkey: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 seamonkey: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 seamonkey: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by
Bugzilla
CVE-2026-45623 python-jupyterlab_pygments: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 python-jupyterlab_pygments: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
CVE-2026-45623 python-jupyterlab_pygments: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any f
Bugzilla
CVE-2026-45623 thunderbird: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 thunderbird: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 thunderbird: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable
Bugzilla
CVE-2026-45623 python-jupyterlab-widgets: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 python-jupyterlab-widgets: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 python-jupyterlab-widgets: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any
Bugzilla
CVE-2026-45623 qgis: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 qgis: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 qgis: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node
Bugzilla
CVE-2026-45623 mozjs140: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 mozjs140: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 mozjs140: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by
Bugzilla
CVE-2026-45623 mozjs78: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 mozjs78: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
CVE-2026-45623 mozjs78: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Nod
Bugzilla
CVE-2026-45623 forgejo: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 forgejo: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 forgejo: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by N
Bugzilla
CVE-2026-45623 llama-cpp: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 llama-cpp: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 llama-cpp: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by
Bugzilla
CVE-2026-45623 firefox: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 firefox: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 firefox: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by N
Bugzilla
CVE-2026-45623 icecat: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 icecat: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 icecat: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by No
Bugzilla
CVE-2026-45623 forgejo: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 forgejo: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
CVE-2026-45623 forgejo: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Nod
Bugzilla
CVE-2026-45623 goose: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 goose: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 goose: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Nod
Bugzilla
CVE-2026-45623 jupyterlab: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 jupyterlab: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
CVE-2026-45623 jupyterlab: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by
Bugzilla
CVE-2026-45623 nodejs-cssnano-preset-advanced: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 nodejs-cssnano-preset-advanced: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 nodejs-cssnano-preset-advanced: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read
Bugzilla
CVE-2026-45623 phpMyAdmin: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 phpMyAdmin: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
CVE-2026-45623 phpMyAdmin: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by
Bugzilla
CVE-2026-45623 openbao: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 openbao: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 openbao: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by N
Bugzilla
CVE-2026-45623 h3: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 h3: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 h3: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node a
Bugzilla
CVE-2026-45623 staticcheck: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 staticcheck: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
CVE-2026-45623 staticcheck: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by
Bugzilla
CVE-2026-45623 mozjs115: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 mozjs115: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 mozjs115: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by
Bugzilla
CVE-2026-45623 nodejs-aw-webui: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 nodejs-aw-webui: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 nodejs-aw-webui: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file reada
Bugzilla
CVE-2026-45623 qgis: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 qgis: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
CVE-2026-45623 qgis: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node a
Bugzilla
CVE-2026-45623 fbthrift: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 fbthrift: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
CVE-2026-45623 fbthrift: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by No
Bugzilla
CVE-2026-45623 phpMyAdmin: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 phpMyAdmin: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 phpMyAdmin: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable b
Bugzilla
CVE-2026-45623 openbao: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 openbao: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
CVE-2026-45623 openbao: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Nod
Bugzilla
CVE-2026-45623 python-jupyterlab_pygments: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 python-jupyterlab_pygments: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 python-jupyterlab_pygments: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any
Bugzilla
CVE-2026-45623 grafana: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 grafana: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 grafana: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by N
Bugzilla
CVE-2026-45623 python-ipyparallel: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 python-ipyparallel: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 python-ipyparallel: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file re
Bugzilla
CVE-2026-45623 golang-github-apache-beam-2: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 golang-github-apache-beam-2: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 golang-github-apache-beam-2: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read an
Bugzilla
CVE-2026-45623 fcitx5: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 fcitx5: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 fcitx5: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by No
Bugzilla
CVE-2026-45623 postcss-cli: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 postcss-cli: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 postcss-cli: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable
Bugzilla
CVE-2026-45623 python-nbdime: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 python-nbdime: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 python-nbdime: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readabl
Bugzilla
CVE-2026-45623 python-ipyparallel: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 python-ipyparallel: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
CVE-2026-45623 python-ipyparallel: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file read
Bugzilla
CVE-2026-45623 seamonkey: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 seamonkey: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
CVE-2026-45623 seamonkey: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by N
Bugzilla
CVE-2026-45623 jupyterlab: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 jupyterlab: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 jupyterlab: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable b
Bugzilla
CVE-2026-45623 trivy: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 trivy: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
CVE-2026-45623 trivy: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node
Bugzilla
CVE-2026-45623 qt6-qtwebengine: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 qt6-qtwebengine: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
CVE-2026-45623 qt6-qtwebengine: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readabl
Bugzilla
CVE-2026-45623 staticcheck: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 staticcheck: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 staticcheck: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable
Bugzilla
CVE-2026-45623 python-jupyterlab-widgets: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 python-jupyterlab-widgets: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
CVE-2026-45623 python-jupyterlab-widgets: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any fi
Bugzilla
CVE-2026-45623 cachelib: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 cachelib: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
CVE-2026-45623 cachelib: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by No
Bugzilla
CVE-2026-45623 frama-c: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 frama-c: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 frama-c: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by N
Bugzilla
CVE-2026-45623 nodejs-cssnano: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 nodejs-cssnano: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
CVE-2026-45623 nodejs-cssnano: PostCSS: Information disclosure and denial of service via crafted CSS input [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readab
Bugzilla
CVE-2026-45623 goose: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
bugzilla·2026-09-24·CVSS 9.1
CVE-2026-45623 [CRITICAL] CVE-2026-45623 goose: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
CVE-2026-45623 goose: PostCSS: Information disclosure and denial of service via crafted CSS input [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node
Bugzilla
CVE-2026-45623 postcss: PostCSS: Information disclosure and denial of service via crafted CSS input
bugzilla·2026-07-27·CVSS 7.5
CVE-2026-45623 [HIGH] CVE-2026-45623 postcss: PostCSS: Information disclosure and denial of service via crafted CSS input
CVE-2026-45623 postcss: PostCSS: Information disclosure and denial of service via crafted CSS input
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for D
2026-07-27
Published