Read the docs
TI-2026-51730 Aliases CVE-2026-73646GHSA-r28c-9q8g-f849

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

Priority HIGH 72CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 12 fixed, 17 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0053 45th percentileScored 2026-11-07
Fix Partial postcss (postcss): 8.5.18postcss (npm): 8.5.18Red Hat: 17 advisoriesRed Hat: 12 fixed, 17 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
postcsspostcssbefore 8.5.188.5.18Patch availableCNA
—postcss (npm)before 8.5.188.5.18Patch availableGHSA-r28c-9q8g-f849
  • postcss Vendorpostcss Affected before 8.5.18 Fixed in 8.5.18 Patch available CNA
  • postcss (npm) Vendor— Affected before 8.5.18 Fixed in 8.5.18 Patch available GHSA-r28c-9q8g-f849

Remediation

  • Fix · CNA postcss (postcss) Fixed in 8.5.18
  • Fix · GHSA-r28c-9q8g-f849 postcss (npm) Fixed in 8.5.18 Advisory →

Red Hat 17 advisories

  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
Show 14 more Red Hat advisories
  • RHSA-2026:83598 Released 2026-10-15 · Red Hat rating Important
    RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
  • RHSA-2026:70829 Released 2026-09-23 · Red Hat rating Important
    RHTAS 1.3.8 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
  • RHSA-2026:68765 Released 2026-09-17 · Red Hat rating Important
    Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
  • RHSA-2026:68756 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:68755 Released 2026-09-17 · Red Hat rating Important
    Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
  • RHSA-2026:68754 Released 2026-09-17 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.1 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +2
  • RHSA-2026:68748 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-advisor-frontend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
  • RHSA-2026:68750 Released 2026-09-17 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:68681 Released 2026-09-17 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.8.17 update
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-registry-rhel8, registry.redhat.io/rhmtc/openshift-migration-ui-rhel8
  • RHSA-2026:67540 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.12 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +5
  • RHSA-2026:67538 Released 2026-09-15 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.12 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/grafana-dashboard-loader-rhel9 +8
  • RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.0 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
  • RHSA-2026:54520 Released 2026-08-13 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images prometheus3.5-3.5.5-0.8.hum1@aarch64, prometheus3.5-3.5.5-0.8.hum1@src, prometheus3.5-3.5.5-0.8.hum1@x86_64
  • RHSA-2026:50287 Released 2026-08-04 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images prometheus3.13-3.13.2-0.2.hum1@aarch64, prometheus3.13-3.13.2-0.2.hum1@src, prometheus3.13-3.13.2-0.2.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Node HealthCheck OperatorAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix planned: Will not fix
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Ceph Storage 4AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Secrets Management Console for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:67538
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:67540
Red Hat Hardened ImagesFixed RHSA-2026:50287, RHSA-2026:54520
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:68681
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat OpenShift AI 3.5Fixed RHSA-2026:86891
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:62260, RHSA-2026:68754
Red Hat Satellite 6.18Fixed RHSA-2026:68756, RHSA-2026:68765
Red Hat Satellite 6.19Fixed RHSA-2026:68748, RHSA-2026:68750, RHSA-2026:68755
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:70829
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:83598
Not affected: 44 products
  • Cost Management On Premise
  • Gatekeeper 3
  • Multicluster Engine for Kubernetes
  • OpenShift Lightspeed
  • OpenShift Pipelines
  • OpenShift Service Mesh 3
  • Red Hat 3scale API Management Platform 2
  • Red Hat AMQ Broker 7
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Keycloak
  • Red Hat Ceph Storage 6
  • Red Hat Ceph Storage 7
  • Red Hat Ceph Storage 8
  • Red Hat Ceph Storage 9
  • Red Hat Certification Program for Red Hat Enterprise Linux 9
  • Red Hat Connectivity Link 1
  • Red Hat Data Grid 8
  • Red Hat Developer Hub 1
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Migration Toolkit 1.8
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift AI 3.5
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat OpenShift GitOps
  • Red Hat Quay 3
  • Red Hat Satellite 6
  • Red Hat Trusted Artifact Signer
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat Trusted Artifact Signer 1.4
  • Red Hat build of Apache Camel for Spring Boot 4
  • Self-service automation portal 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73646
  2. 2026-10-03 Alias added: GHSA-r28c-9q8g-f849
  3. 2026-10-06 Affected versions changed · Red Hat
  4. 2026-10-08 Affected versions changed · Red Hat
  5. 2026-10-16 Fix available: RHSA-2026:83598 · Red Hat
  6. 2026-10-16 Fix available: Red Hat Trusted Artifact Signer 1.4 · Red Hat
  7. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  8. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  9. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  10. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  11. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.5 · Red Hat
  12. 2026-10-27 Affected versions changed · Red Hat
  13. 2026-10-30 Affected versions changed · Red Hat

References

Other 4

  • TI-2026-33367 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments CVSS 3.1CRITICAL 9.1
  • TI-2026-48533 Information disclosure in postcss CVSS 4.0MEDIUM 6.3
  • TI-2026-29908 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output CVSS 3.1MEDIUM 6.1
  • TI-2021-06075 Regular expression denial of service (ReDoS) in postcss CVSS 3.1HIGH 7.5
  • TI-2023-23794 An issue was discovered in PostCSS before 8.4.31. CVSS 3.1MEDIUM 5.3
  • TI-2021-06061 Regular expression denial of service (ReDoS) in postcss CVSS 3.1MEDIUM 5.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences