CVE-2026-41305

Name of the Vulnerable Software and Affected Versions PostCSS versions prior to 8.5.10

Description PostCSS transforms CSS files into an Abstract Syntax Tree (AST) to analyze and modify rules. The software fails to escape </style> sequences when stringifying CSS ASTs. If user-submitted CSS is parsed and then re-stringified for embedding within HTML <style> tags, the </style> sequence in CSS values can break out of the style context, allowing for Cross-Site Scripting (XSS).

Recommendations Update to version 8.5.10.