GHSA-6g55-p6wh-862q high
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
Affected range
SEMVER: introduced 0; fixed 8.5.12Fixed versions: 8.5.12
postcss
Tool for transforming styles with JS plugins
npm latest 8.5.28 MIT
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
8.5.28
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
High
7 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-r28c-9q8g-f849 high
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
Affected range
SEMVER: introduced 0; fixed 8.5.18Fixed versions: 8.5.18
GHSA-qx2v-qp2m-jg93 moderate
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
Affected range
SEMVER: introduced 0; fixed 8.5.10Fixed versions: 8.5.10
GHSA-fxqj-rqcc-2cmp moderate
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
Affected range
SEMVER: introduced 0; fixed 8.5.23Fixed versions: 8.5.23
GHSA-7fh5-64p2-3v2j moderate
PostCSS line return parsing error
Affected range
SEMVER: introduced 0; fixed 8.4.31Fixed versions: 8.4.31
GHSA-hwj9-h5mp-3pm3 moderate
Regular Expression Denial of Service in postcss
Affected range
SEMVER: introduced 7.0.0; fixed 7.0.36SEMVER: introduced 8.0.0; fixed 8.2.10Fixed versions: 7.0.36, 8.2.10
GHSA-566m-qj78-rww5 moderate
Regular Expression Denial of Service in postcss
Affected range
SEMVER: introduced 8.0.0; fixed 8.2.13SEMVER: introduced 0; fixed 7.0.36Fixed versions: 8.2.13, 7.0.36