CVE-2026-69153

Name of the Vulnerable Software and Affected Versions PostCSS versions prior to 8.5.19

Description PostCSS transforms CSS files into an Abstract Syntax Tree to allow analysis and modification. When the from option is unset, the PreviousMap.loadFile() function fails to properly validate the sourceMappingURL provided in a CSS comment. An attacker can supply an absolute path or a directory-traversal path to force the application to read an unintended source-map file. If the targeted file ends with a .map extension and contains valid JSON, its sources (local filesystem paths) and sourcesContent (source code) may be exposed in the generated source map. This issue affects environments where PostCSS processes attacker-influenced CSS without a specified from option and exposes the resulting map.

Recommendations Update PostCSS to version 8.5.19 or later. As a temporary mitigation, ensure the from option is always set when processing CSS to enable the path validation guard.