Vulnerabilities in postcss
5 resultsCVE-2026-45623HIGHPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS commentsEPSS 0.6%CVE-2026-73646HIGHPostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File DisclosureEPSS 0.5%CVE-2026-69153MEDIUMPostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unsetEPSS 0.5%CVE-2026-104844MEDIUMPostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustionEPSS 0.4%CVE-2026-41305MEDIUMPostCSS has XSS via Unescaped </style> in its CSS Stringify OutputEPSS 0.2%