npm/postcss CVE-2026-73646: high 7.5, EPSS 0.53%
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
Action: Upgrade postcss to 8.5.18 or later.
npm i postcss@8.5.18Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 8.5.18 | - |
Fixed versions
| 8.5.18 |
Sources
- osv: GHSA-r28c-9q8g-f849
- https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849
- https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c
- https://github.com/postcss/postcss
- https://github.com/postcss/postcss/releases/tag/8.5.18
CVE-2026-73646 · published · modified · JSON