{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"node-postcss","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NTX512WNM855G3SPGV76X5","modified_at":"2026-10-01T03:02:56.542469441Z","published_at":"2026-08-03T17:16:46.127Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-69153","https://security-tracker.debian.org/tracker/CVE-2026-69153"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-69153","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-69153"}],"summary":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMa"}