CVE-2026-45623

Name of the Vulnerable Software and Affected Versions PostCSS versions 8.5.11 and earlier

Description PostCSS processes CSS files by transforming them into an Abstract Syntax Tree. The PreviousMap component parses /*# sourceMappingURL=PATH */ comments from CSS strings passed to the process() function and accesses the PATH on the local filesystem without implementing scheme validation, allowlists, or traversal checks. An attacker providing malicious CSS input can force the host process to read any file accessible by Node.js. This can lead to the disclosure of the first ~10 bytes of the file content through a JSON.parse SyntaxError message. Additionally, this issue creates a file-existence oracle and a controllable-read primitive that can be used to cause a Denial of Service (DoS) by targeting large files or device files. This behavior occurs with default options and affects any pipeline processing untrusted CSS, such as CMS themes, user-uploaded styles, or build pipelines for third-party packages.

Recommendations Update PostCSS to version 8.5.12. As a temporary workaround, set the map option to false when calling the process() function to disable the vulnerable behavior.