CoreCVE
Back

MEDIUM

PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

Published Aug 3, 2026

Description

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.

Affected products

Remediation

Red Hat statement

Red Hat rates this flaw as Moderate because the information disclosed is limited to files with a .map extension. Source map files may contain source code paths and content, but the attacker cannot read arbitrary files on the system. Exploitation requires the application to process attacker-controlled CSS through PostCSS on the server side.

Red Hat mitigation

Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-22

Path Traversal

References (9)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner GitHub_M
Published Aug 3, 2026
Updated Aug 3, 2026
Reserved Aug 3, 2026
Link CVE-2026-69153

CISA Vulnrichment

Updated Aug 3, 2026

NVD

Status Analyzed
Modified Aug 5, 2026
Link CVE-2026-69153

Red Hat

Severity Moderate
Public date Aug 3, 2026
Bugzilla 2510719
Link CVE-2026-69153

ENISA EUVD

Assigner GitHub_M
Published Aug 3, 2026
Updated Aug 3, 2026
Link EUVD-2026-52373

GitHub

Link GHSA-FXQJ-RQCC-2CMP