Read the docs

postcss

Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

postcss records in CISA KEV

No postcss vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Postcss 5 records HIGH

Records

8 records

TI-2026-48533 CVE-2026-69153 · GHSA-fxqj-rqcc-2cmp

Information disclosure in postcss

Priority MEDIUM 61

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00451 Published 2026-08-03 Partial fix · 8.5.19, 8.5.23 CWE-200
TI-2026-29908 CVE-2026-41305 · GHSA-qx2v-qp2m-jg93

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

Priority MEDIUM 60

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00205 Published 2026-04-24 Partial fix · 8.5.10 CWE-79
TI-2021-06075 CVE-2021-23382 · GHSA-566m-qj78-rww5

Regular expression denial of service (ReDoS) in postcss

Priority LOW 38

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02557 Published 2021-04-26 Partial fix · 8.2.13, 7.0.36 CWE-1333
TI-2021-06061 CVE-2021-23368 · GHSA-hwj9-h5mp-3pm3

Regular expression denial of service (ReDoS) in postcss

Priority LOW 30

The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03511 Published 2021-04-12 Partial fix · 8.2.10, 7.0.36 CWE-400
Open these records in search →