CVE-2026-69153
Awaiting Analysis Awaiting Analysis - Queue

PostCSS Source Map File Disclosure Vulnerability

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: GitHub, Inc.

Description
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-69153
EUVD
EUVD-2026-52373

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
postcss postcss to 8.5.19 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

PostCSS is a tool that processes CSS files by converting them into an Abstract Syntax Tree for analysis and modification. In versions before 8.5.19, if the 'from' parameter is not set, an attacker can manipulate the sourceMappingURL to read unintended source-map files via absolute paths or directory traversal. This could expose sensitive data like sources and sourcesContent from the map to the application.

Detection Guidance

To detect this vulnerability, check if your PostCSS version is below 8.5.19. Run: npm list postcss or grep "postcss" package.json. If the version is outdated, update PostCSS immediately to 8.5.19 or later.

Impact Analysis

If you use PostCSS versions prior to 8.5.19, an attacker could access sensitive information from source-map files, such as original CSS sources or content. This may lead to data leaks, intellectual property theft, or further exploitation if the exposed data contains credentials or internal paths.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) if exposed data includes personal or health-related information. Compliance may be impacted if the breach results in data exposure or loss of confidentiality.

Mitigation Strategies

Update PostCSS to version 8.5.19 or later to address the vulnerability. Review CSS files for unintended source-map exposure and ensure from is properly set to prevent directory traversal.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69153. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart