CVE-2026-41305
1 advisory.
npm/postcss CVE-2026-41305: medium 6.1, EPSS 0.26%
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
Action: Upgrade postcss to 8.5.10 or later.
npm i postcss@8.5.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 8.5.10 | - |
Fixed versions
| 8.5.10 |
Sources
- osv: GHSA-qx2v-qp2m-jg93
- https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93
- https://nvd.nist.gov/vuln/detail/CVE-2026-41305
- https://github.com/postcss/postcss
- https://github.com/postcss/postcss/releases/tag/8.5.10
CVE-2026-41305 · published · modified · JSON