Postcss

Postcss

8 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2026-73646

  • EPSS 0.38%
  • Veröffentlicht 17.08.2026 15:35:13
  • Zuletzt bearbeitet 17.08.2026 17:16:51

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opt...

5.3

CVE-2026-69153

Exploit
  • EPSS 0.36%
  • Veröffentlicht 03.08.2026 16:56:25
  • Zuletzt bearbeitet 05.08.2026 14:58:45

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file...

9.1

CVE-2026-45623

Exploit
  • EPSS 0.61%
  • Veröffentlicht 27.07.2026 18:16:55
  • Zuletzt bearbeitet 07.08.2026 00:13:41

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string pas...

5

CVE-2026-9358

Exploit
  • EPSS 0.33%
  • Veröffentlicht 24.05.2026 05:30:09
  • Zuletzt bearbeitet 23.07.2026 11:10:00

A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It ...

6.1

CVE-2026-41305

  • EPSS 0.21%
  • Veröffentlicht 24.04.2026 02:27:47
  • Zuletzt bearbeitet 24.04.2026 17:16:21

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is pa...

5.3

CVE-2023-44270

  • EPSS 0.82%
  • Veröffentlicht 29.09.2023 22:15:11
  • Zuletzt bearbeitet 03.11.2025 22:16:27

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After process...

7.5

CVE-2021-23382

Exploit
  • EPSS 2.51%
  • Veröffentlicht 26.04.2021 16:15:07
  • Zuletzt bearbeitet 21.11.2024 05:51:36

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=...

5.3

CVE-2021-23368

Exploit
  • EPSS 3.54%
  • Veröffentlicht 12.04.2021 14:15:14
  • Zuletzt bearbeitet 21.11.2024 05:51:35

The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.