cbcvebase.
CVE-2026-73646
published 2026-08-17

CVE-2026-73646: PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18…

PriorityP349high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.53%
43.5th percentile
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.

Affected

54 ranges· showing 25
VendorProductVersion rangeFixed in
3scale-amp2system-rhel8——
ansible-automation-platform-26gateway-rhel9——
ansible-automation-platform-27gateway-rhel9——
apicurioapicurio-registry-ui-rhel8——
clusterlabspcs——
devspacescode-rhel9——
devspacesdashboard-rhel9——
devspacesopenvsx-rhel9——
external-secrets-managementconsole-plugin-rhel9——
gatekeepergatekeeper-rhel9——
grafanagrafana——
odf4ocs-client-console-rhel9——
odf4odf-console-rhel9——
odf4odf-multicluster-console-rhel9——
openshift-pipelinespipelines-hub-ui-rhel8——
openshift-pipelinespipelines-hub-ui-rhel9——
openshift-service-meshkiali-operator-bundle——
openshift-service-meshkiali-rhel9-operator——
openshift4ose-agent-installer-ui-rhel9——
openshift4ose-console——
openshift4ose-console-rhel9——
postcsspostcss< 8.5.188.5.18
postcsspostcss——
quayquay-rhel9——
rhacm2console-rhel9——

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.