VulnSocial

CVE-2026-45623Disclosure(postcss / postcss)

LOWCVSS 9.1 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch postcss postcss systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.

postcss CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-22CWE-200

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • postcss

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 1 signal
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-07-27)
  • 4 total mentions across 3 days

Affected systems

Vendors
postcss
Products
postcss

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-07-23: 1Mentions · 2026-07-24: 1Mentions · 2026-07-27: 2Patch / Workaround · 2026-07-23: 1Patch / Workaround · 2026-07-24: 1Technical Details · 2026-07-23: 107-2307-2407-27
Signal classification3 categories
Disclosure
250.0%
Patch
125.0%
General
125.0%
Referenced assets2 URLs
By indicator
Classification over time
DateTotalLabels
2026-07-231
Disclosure1
2026-07-241
Patch1
2026-07-272
Disclosure1General1
Full discourse4 posts
  • Repojournal@repojournal
    Patch

    Workflow patches CVE-2026-64641 (Next.js 16.2.11) and CVE-2026-45623 (PostCSS >=8.5.12) overnight. Both flagged critical. Workflow also tightened HTTP delivery shutdown and added stream overhead benchmarks to catch regressions earlier. Next.js got client-trace attribution in the render pipeline. Benchmarks now document what they measure. Vercel CLI: team scope now persists across re-login (fixes the `vc switch` stale-team wedge). New opt-in native binary trampoline. First deploy to production now gets a heads-up notice. Eve locked down workflow failure visibility. Private by default now. Full diff + who shipped it below. #nextjs

    Post summary

    Vercel released patches for CVE-2026-64641 and CVE-2026-45623, summarizing the updates and noting a critical flag, but the post does not discuss exploits, active use, or detailed technical aspects of the vulnerabilities.

    12030199
    364 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-45623 PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the… https://www.cve.org/CVERecord?id=CVE-2026-45623 ----- Traducción: CVE-2026-45623 Pos… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-45623 for PostCSS, offering minimal technical details and a link to the CVE page, without any indication of exploits, patches, or PoC.

    0000024
    95 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-45623 PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the… https://www.cve.org/CVERecord?id=CVE-2026-45623

    Post summary

    The post mentions CVE-2026-45623 for PostCSS and notes affected versions, but provides no technical depth, exploit details, or mitigation guidance.

    00000965
    57.9K followersView on X
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨High - PostCSS Arbitrary File Read via sourceMappingURL in CSS Comments (CVE-2026-45623) PostCSS parses the /*# sourceMappingURL=PATH */ comment from any CSS passed to process() and reads PATH from the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can make the Node process read any file it can access and leak the first ~10 bytes via the resulting JSON.parse SyntaxError (e.g. root:x:0:0, API_KEY=sk...). It also gives a file-existence oracle and a controllable-read DoS primitive, and it triggers with default options - no from, no map, no plugins. Any pipeline running untrusted CSS through PostCSS (theme uploads, user styles, multi-tenant build farms) is exposed. CVSS 7.5. 👉Upgrade postcss to 8.5.12.

    Post summary

    CVE-2026-45623 exposes an arbitrary file read flaw in PostCSS via sourceMappingURL comments, with a CVSS 7.5 score. The issue can be mitigated by upgrading to postcss v8.5.12.

    0000086
    254 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apppostcsspostcss-node.js-

Explore more

Back to dashboardpostcss CVEspostcss vulnerabilities