TI-2026-66130 CVE-2026-104844 · GHSA-rj75-hqrm-r3gf
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
Priority LOW 27
PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it.
Vulnerabilities
8 records
TI-2026-51730 CVE-2026-73646 · GHSA-r28c-9q8g-f849
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
Priority HIGH 72
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
TI-2026-48533 CVE-2026-69153 · GHSA-fxqj-rqcc-2cmp
Information disclosure in postcss
Priority MEDIUM 61
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
TI-2026-33367 CVE-2026-45623 · GHSA-6g55-p6wh-862q
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
Priority HIGH 78
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
TI-2026-29908 CVE-2026-41305 · GHSA-qx2v-qp2m-jg93
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
Priority MEDIUM 60
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.
TI-2023-23794 CVE-2023-44270 · GHSA-7fh5-64p2-3v2j
An issue was discovered in PostCSS before 8.4.31.
Priority LOW 32
An issue was discovered in PostCSS before 8.4.31.
TI-2021-06075 CVE-2021-23382 · GHSA-566m-qj78-rww5
Regular expression denial of service (ReDoS) in postcss
Priority LOW 38
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js.
TI-2021-06061 CVE-2021-23368 · GHSA-hwj9-h5mp-3pm3
Regular expression denial of service (ReDoS) in postcss
Priority LOW 30
The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.