postcss vulnerabilities
5 published CVEs name postcss among the affected products.
- 5Published CVEs5 of them scored
- 5Last 12 monthspublished in the last year
- 0Critical2 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-104844
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
postcss · postcss-selector-parser
Medium5.9 - CVE-2026-73646
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
postcss · postcss
High7.5 - CVE-2026-69153
PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
postcss · postcss
Medium6.3 - CVE-2026-45623
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
postcss · postcss
High7.5 - CVE-2026-41305
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
postcss · postcss
Medium6.1