{"action":"Upgrade postcss to 8.5.23 or later.","affected":[{"fixed":"8.5.23","introduced":"0"}],"component":"postcss","cve_ids":["CVE-2026-69153"],"ecosystem":"npm","epss":0.00451,"exploited":false,"fixed_versions":["8.5.23"],"ghsa_id":"GHSA-fxqj-rqcc-2cmp","id":"tcs_01M5KFPMDQJ4SWJ07CVW5N6YSJ","modified_at":"2026-09-10T03:50:53.572374167Z","published_at":"2026-08-03T17:11:39Z","references":["https://osv.dev/vulnerability/GHSA-fxqj-rqcc-2cmp","https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","https://github.com/postcss/postcss","https://github.com/postcss/postcss/releases/tag/8.5.19"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-fxqj-rqcc-2cmp","url":"https://osv.dev/vulnerability/GHSA-fxqj-rqcc-2cmp"}],"summary":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset"}