Postcss vulnerabilities

2 known vulnerabilities in Postcss from Postcss. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  postcss: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-73646Aug 17, 2026Postcss

  PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), a

• 9.1 Critical severity

  postcss: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-45623Jul 27, 2026Postcss

  PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to pro