CVE-2026-73646

Name of the Vulnerable Software and Affected Versions PostCSS versions prior to 8.5.18

Description PostCSS transforms CSS files into an Abstract Syntax Tree for analysis and modification. A path traversal issue exists in lib/previous-map.js where the loadMap() function passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and the loadFile() function allows absolute or traversed .map paths. This allows untrusted CSS processed without the map: false option to disclose sourcesContent from arbitrary reachable .map files via result.map.

Recommendations Update to version 8.5.18. As a temporary mitigation, process untrusted CSS using the map: false option.