CVE-2026-9358
published 2026-05-24CVE-2026-9358: A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the…
PriorityP421medium4.3CVSS 3.1
AVNACLPRNUIRSUCNINAL
EPSS
0.33%
25.4th percentile
A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 6.1.3 and 7.1.3 is able to address this issue. This patch is called 5bc698cef66f8abd12610dc623e5d67cbc0f869d. It is suggested to upgrade the affected component. The vendor explains, that according to his definition "DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS)." The commits were backported to 6.x branch, which was the most downloaded version.
Affected
73 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | system-rhel7 | — | — |
| 3scale-amp2 | system-rhel8 | — | — |
| 3scale-amp2 | system-rhel9 | — | — |
| 3scale-amp21 | system | — | — |
| 3scale-amp22 | system | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-27 | gateway-rhel9 | — | — |
| ansible-automation-platform | automation-portal | — | — |
| apicurio | apicurio-registry-ui-rhel8 | — | — |
| apicurio | apicurio-registry-ui-rhel9 | — | — |
| clusterlabs | pcs | — | — |
| container-native-virtualization | kubevirt-console-plugin | — | — |
| container-native-virtualization | kubevirt-console-plugin-rhel9 | — | — |
| devspaces | dashboard-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| discovery | discovery-ui-rhel9 | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| gatekeeper | gatekeeper-rhel9 | — | — |
| grafana | grafana | — | — |
| mozilla | firefox | — | — |
| mozilla | thunderbird | — | — |
| multicluster-engine | console-mce-rhel9 | — | — |
| network-observability | network-observability-console-plugin-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel8 | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
cvelistv5v4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
postcss-selector-parser allows denial of service through uncontrolled AST recursion
ghsa·2026-05-26
CVE-2026-9358 [LOW] CWE-404 postcss-selector-parser allows denial of service through uncontrolled AST recursion
postcss-selector-parser allows denial of service through uncontrolled AST recursion
A vulnerability was determined in postcss-selector-parser before 6.1.3 and 7.1.1. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains, that according to his definition "DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS)."
GHSA
GHSA-w9m9-85wc-3x92: A vulnerability was determined in postcss up to 7
ghsa_unreviewed·2026-05-26
CVE-2026-9358 [LOW] CWE-404 GHSA-w9m9-85wc-3x92: A vulnerability was determined in postcss up to 7
A vulnerability was determined in postcss up to 7.1.1. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains, that according to his definition "DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS)."
CVEList
postcss AST Serialization container.js toString recursion
cvelistv5·2026-05-24·CVSS 5.3
CVE-2026-9358 [MEDIUM] CWE-674 postcss AST Serialization container.js toString recursion
postcss AST Serialization container.js toString recursion
A vulnerability was determined in postcss up to 7.1.1. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains, that according to his definition "DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS)."
Timeline: 2026-05-23: Advisory disclosed; 2026-05-23: VulDB entry created; 2026-05-23: VulDB entry last update
VulDB
postcss up to 7.1.1 AST Serialization container.js toString recursion
vuldb·2026-05-23
CVE-2026-9358 [LOW] postcss up to 7.1.1 AST Serialization container.js toString recursion
A vulnerability was found in postcss up to 7.1.1 and classified as problematic. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion.
This vulnerability is registered as CVE-2026-9358. It is possible to launch the attack remotely. Furthermore, an exploit is available.
The vendor explains, that according to his definition "DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS)."
Red Hat
postcss-selector-parser: Postcss: Denial of Service via uncontrolled recursion in AST Serialization
vendor_redhat·2026-05-24·CVSS 4.3
CVE-2026-9358 [MEDIUM] CWE-674 postcss-selector-parser: Postcss: Denial of Service via uncontrolled recursion in AST Serialization
postcss-selector-parser: Postcss: Denial of Service via uncontrolled recursion in AST Serialization
A vulnerability was determined in postcss up to 7.1.1. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains, that according to his definition "DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS)."
A flaw was found in postcss. A remote attacker could exploit a vulnerability in the `toString` function of the AST Serialization component by executing a manipulation, leading to uncontrolled recursion
No detection rules found.
No public exploits indexed.
https://gist.github.com/bx33661/581e3a38134601c04e19b4dfc9b459b9https://github.com/postcss/postcss-selector-parser/commit/5bc698cef66f8abd12610dc623e5d67cbc0f869dhttps://github.com/postcss/postcss-selector-parser/releases/tag/7.1.3https://vuldb.com/cve/CVE-2026-9358https://vuldb.com/submit/813080https://vuldb.com/vuln/365321https://vuldb.com/vuln/365321/cti
2026-05-24
Published