PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
References
| Link | Resource |
|---|---|
| https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8 | Patch |
| https://github.com/postcss/postcss/releases/tag/8.5.19 | Product Release Notes |
| https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp | Exploit Mitigation Vendor Advisory |
| https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp | Exploit Mitigation Vendor Advisory |
Configurations
History
05 Aug 2026, 14:58
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CPE | cpe:2.3:a:postcss:postcss:*:*:*:*:*:node.js:*:* | |
| First Time |
Postcss
Postcss postcss |
|
| References | () https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8 - Patch | |
| References | () https://github.com/postcss/postcss/releases/tag/8.5.19 - Product, Release Notes | |
| References | () https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp - Exploit, Mitigation, Vendor Advisory |
03 Aug 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp - |
03 Aug 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-08-03 17:16
Updated : 2026-08-05 14:58
NVD link : CVE-2026-69153
Mitre link : CVE-2026-69153
CVE.ORG link : CVE-2026-69153
JSON object : View
Products Affected
postcss
- postcss