Postcss vulnerabilities
We track 2 vulnerabilities in Postcss products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 17, 2026.
2vulnerabilities
1critical
1high
0exploited
8.3average CVSS score
Latest Postcss vulnerabilities
- 7.5 High severity
postcss: Improper Limitation of a Pathname to a Restricted Directory
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), a
- 9.1 Critical severity
postcss: Improper Limitation of a Pathname to a Restricted Directory
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to pro