npm/postcss CVE-2026-69153: medium, EPSS 0.45%
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
Action: Upgrade postcss to 8.5.23 or later.
npm i postcss@8.5.23Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 8.5.23 | - |
Fixed versions
| 8.5.23 |
Sources
- osv: GHSA-fxqj-rqcc-2cmp
- https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp
- https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8
- https://github.com/postcss/postcss
- https://github.com/postcss/postcss/releases/tag/8.5.19
CVE-2026-69153 · published · modified · JSON