CVE-2026-45623
1 advisory.
npm/postcss CVE-2026-45623: high 7.5, EPSS 0.61%
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
Action: Upgrade postcss to 8.5.12 or later.
npm i postcss@8.5.12Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 8.5.12 | - |
Fixed versions
| 8.5.12 |
Sources
- osv: GHSA-6g55-p6wh-862q
- https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q
- https://github.com/postcss/postcss/commit/aaec7b78b3ce2792585b4b300ef1bd5dd5b3e8ad
- https://github.com/postcss/postcss/commit/c64b7488d2731dfa16213739b42c34faf5a9eba3
- https://github.com/postcss/postcss
- https://github.com/postcss/postcss/releases/tag/8.5.12
CVE-2026-45623 · published · modified · JSON