Postcss

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 5.9MediumOct 2, 2026postcss-selector-parser Denial of serviceCVE-2026-104844PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanni
• 7.5HighAug 17, 2026postcss Path traversal / file handlingCVE-2026-73646PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.1
• 5.3MediumAug 3, 2026postcss Path traversal / file handlingCVE-2026-69153PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
• 7.5HighJul 27, 2026postcss Path traversal / file handlingCVE-2026-45623PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the

See every Postcss entry on the dashboard.

Top products

• postcss3 CVEs in the last year
• postcss-selector-parser1 CVE in the last year

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• Atlassian · Sep 15, 2026Atlassian Security Bulletin September 15, 2026CVE-2026-45623CVE-2026-73646