CVE-2026-73646highCWE-22

CVE-2026-73646: falha de alta gravidade em postcss

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

Publicada em

Seguir esta CVE+ Monitorar postcss+ Monitorar node-postcss

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.5%
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
postcss · postcss
CVEs relacionadas — postcss

No mesmo produto, das mais perigosas para as menos.

CVE-2026-45623HIGHPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS commentsEPSS 0.6%CVE-2026-69153MEDIUMPostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unsetEPSS 0.5%CVE-2026-41305MEDIUMPostCSS has XSS via Unescaped </style> in its CSS Stringify OutputEPSS 0.2%