CVE-2026-69153
published 2026-08-03CVE-2026-69153: PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from…
PriorityP432medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.45%
37.7th percentile
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Affected
67 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | system-rhel7 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-27 | gateway-rhel9 | — | — |
| ansible-automation-platform | automation-portal | — | — |
| apicurio | apicurio-registry-ui-rhel8 | — | — |
| clusterlabs | pcs | — | — |
| container-native-virtualization | kubevirt-console-plugin-rhel9 | — | — |
| devspaces | code-rhel9 | — | — |
| devspaces | dashboard-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| discovery | discovery-ui-rhel9 | — | — |
| external-secrets-management | console-plugin-rhel9 | — | — |
| gatekeeper | gatekeeper-rhel9 | — | — |
| grafana | grafana | — | — |
| mozilla | firefox | — | — |
| mozilla | thunderbird | — | — |
| multicluster-engine | console-mce-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
| openshift-lightspeed | lightspeed-agentic-console-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-419-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-pf5-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-rhel9 | — | — |
| openshift-pipelines | pipelines-console-plugin-pf5-rhel9 | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
postcss: PostCSS: Information disclosure via crafted sourceMappingURL
vendor_redhat·2026-08-03·CVSS 6.3
CVE-2026-69153 [MEDIUM] CWE-22 postcss: PostCSS: Information disclosure via crafted sourceMappingURL
postcss: PostCSS: Information disclosure via crafted sourceMappingURL
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application's source code.
Package: cryostat-openshift-console-plugin-npm (Cryostat 4) - Affected
Package: grafana-infinity-datasource-npm (Cryostat 4) - Affected
Package: postcss (Cryostat 4) - Affected
Package: gatekeeper/gatekeeper-rhel9 (Gatekeeper 3) - Affected
Package: rhmtc/openshift-migration-ui-rhel8 (Migration Toolkit for Containers) - Affected
Package: multicluster-engine/console-mce
GHSA
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
ghsa·2026-08-03
CVE-2026-69153 [MEDIUM] CWE-22 PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
## Summary
The fix for GHSA-6g55-p6wh-862q added a guard in `lib/previous-map.js` `PreviousMap.loadFile()` that restricts an attacker-controlled `sourceMappingURL` (from a CSS comment) to a `.map` extension and, for untrusted maps, rejects `..` traversal and absolute paths. The traversal/absolute rejection is nested inside `if (cssFile) { ... }`. When PostCSS is invoked without the `from` option, `cssFile` is falsy and that branch is skipped, leaving only the `.map` extension check.
`PreviousMap` is constructed by `lib/input.js` whenever `pathAvailable && sourceMapAvailable` (under Node with source-map available), independent of `opts.from`/`opts.map` (th
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-69153 postcss-cli: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 postcss-cli: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 postcss-cli: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 openbao: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 openbao: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
CVE-2026-69153 openbao: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Discussion:
OpenBao does not have
Bugzilla
CVE-2026-69153 staticcheck: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 staticcheck: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
CVE-2026-69153 staticcheck: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 golang-github-apache-beam-2: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 golang-github-apache-beam-2: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 golang-github-apache-beam-2: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 nodejs-cssnano-preset-advanced: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 nodejs-cssnano-preset-advanced: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 nodejs-cssnano-preset-advanced: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 phpMyAdmin: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 phpMyAdmin: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 phpMyAdmin: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 python-ipyparallel: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 python-ipyparallel: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
CVE-2026-69153 python-ipyparallel: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 python-jupyterlab_pygments: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 python-jupyterlab_pygments: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 python-jupyterlab_pygments: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 mozjs128: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 mozjs128: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 mozjs128: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 qt5-qtwebengine: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 qt5-qtwebengine: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 qt5-qtwebengine: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 python-jupyterlab-widgets: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 python-jupyterlab-widgets: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 python-jupyterlab-widgets: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 thunderbird: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 thunderbird: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 thunderbird: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 cachelib: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 cachelib: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 cachelib: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 frama-c: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 frama-c: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 frama-c: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Discussion:
The JavaScript code
Bugzilla
CVE-2026-69153 fbthrift: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 fbthrift: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
CVE-2026-69153 fbthrift: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 qt6-qtwebengine: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 qt6-qtwebengine: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
CVE-2026-69153 qt6-qtwebengine: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 firefox: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 firefox: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 firefox: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 python-jupytext: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 python-jupytext: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 python-jupytext: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 jupyterlab: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 jupyterlab: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
CVE-2026-69153 jupyterlab: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 trivy: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 trivy: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
CVE-2026-69153 trivy: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 mozjs140: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 mozjs140: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 mozjs140: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 nodejs-cssnano: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 nodejs-cssnano: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 nodejs-cssnano: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 nodejs-aw-webui: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 nodejs-aw-webui: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 nodejs-aw-webui: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 icecat: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 icecat: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 icecat: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 python-nbdime: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 python-nbdime: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 python-nbdime: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 fbthrift: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 fbthrift: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 fbthrift: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 cachelib: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 cachelib: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
CVE-2026-69153 cachelib: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 fcitx5: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 fcitx5: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 fcitx5: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 qgis: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 qgis: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 qgis: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 goose: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 goose: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 goose: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Discussion:
Goose is not affected
Bugzilla
CVE-2026-69153 seamonkey: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 seamonkey: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 seamonkey: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Discussion:
SeaMonkey does no
Bugzilla
CVE-2026-69153 grafana: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 grafana: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 grafana: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 h3: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 h3: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 h3: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 python-jupyterlab-widgets: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 python-jupyterlab-widgets: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
CVE-2026-69153 python-jupyterlab-widgets: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 openbao: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 openbao: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 openbao: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Discussion:
OpenBao does not ha
Bugzilla
CVE-2026-69153 mozjs115: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 mozjs115: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 mozjs115: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 python-ipyparallel: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 python-ipyparallel: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 python-ipyparallel: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 seamonkey: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 seamonkey: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
CVE-2026-69153 seamonkey: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Discussion:
SeaMonkey does not
Bugzilla
CVE-2026-69153 forgejo: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 forgejo: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 forgejo: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 jupyterlab: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 jupyterlab: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 jupyterlab: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 goose: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 goose: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
CVE-2026-69153 goose: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Discussion:
Goose is not affected b
Bugzilla
CVE-2026-69153 python-jupyterlab_pygments: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 python-jupyterlab_pygments: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
CVE-2026-69153 python-jupyterlab_pygments: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 staticcheck: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 staticcheck: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 staticcheck: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 mozjs78: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 mozjs78: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
CVE-2026-69153 mozjs78: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 forgejo: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 forgejo: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
CVE-2026-69153 forgejo: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 qgis: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 qgis: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
CVE-2026-69153 qgis: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 phpMyAdmin: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 phpMyAdmin: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
CVE-2026-69153 phpMyAdmin: PostCSS: Information disclosure via crafted sourceMappingURL [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 llama-cpp: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
bugzilla·2026-09-02·CVSS 5.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 llama-cpp: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
CVE-2026-69153 llama-cpp: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Bugzilla
CVE-2026-69153 postcss: PostCSS: Information disclosure via crafted sourceMappingURL
bugzilla·2026-08-03·CVSS 6.3
CVE-2026-69153 [MEDIUM] CVE-2026-69153 postcss: PostCSS: Information disclosure via crafted sourceMappingURL
CVE-2026-69153 postcss: PostCSS: Information disclosure via crafted sourceMappingURL
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
2026-08-03
Published