UnratedFix available

DEBIAN-CVE-2026-45623

Type: advisorySource: OSV1 source record

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.

Announced 27 Jul 2026Source revision 1

Original source ↗

DEBIAN-CVE-2026-45623

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-45623

node-postcss

Source reference: /affected/0/package/name

Affected versions: 8.4.20+~cs8.0.23-1
Source reference: /affected/0/versions
8.4.20+~cs8.0.23-1+deb12u1
Source reference: /affected/0/versions
8.4.31+~cs8.0.26-1
Source reference: /affected/0/versions
8.4.39+~cs9.2.29-1
Source reference: /affected/0/versions
8.4.49+~cs9.2.32-1
Source reference: /affected/0/versions
8.5.12+~cs9.3.32-1
Source reference: /affected/0/versions
8.5.14+~cs9.3.34-1
Source reference: /affected/0/versions
8.5.15+~cs9.3.34-1
Source reference: /affected/0/versions
8.5.15+~cs9.3.38-1
Source reference: /affected/0/versions
8.5.15+~cs9.3.39-1
Source reference: /affected/0/versions
8.5.19+~cs10.2.23-1
Source reference: /affected/0/versions
8.5.21+~cs10.2.23-1
Source reference: /affected/0/versions
8.5.23+~cs10.2.23-1
Source reference: /affected/0/versions
8.5.25+~cs10.2.23-1
Source reference: /affected/0/versions
8.5.26+~cs10.2.24-1
Source reference: /affected/0/versions
8.5.28+~cs10.2.24-1
Source reference: /affected/0/versions
8.5.6+~cs9.3.28-1
Source reference: /affected/0/versions
8.5.8+~cs9.3.30-1
Source reference: /affected/0/versions
8.5.9+~cs9.3.30-1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

node-postcss

Source reference: /affected/1/package/name

Affected versions: 8.4.49+~cs9.2.32-1
Source reference: /affected/1/versions
8.5.12+~cs9.3.32-1
Source reference: /affected/1/versions
8.5.14+~cs9.3.34-1
Source reference: /affected/1/versions
8.5.15+~cs9.3.34-1
Source reference: /affected/1/versions
8.5.15+~cs9.3.38-1
Source reference: /affected/1/versions
8.5.15+~cs9.3.39-1
Source reference: /affected/1/versions
8.5.19+~cs10.2.23-1
Source reference: /affected/1/versions
8.5.21+~cs10.2.23-1
Source reference: /affected/1/versions
8.5.23+~cs10.2.23-1
Source reference: /affected/1/versions
8.5.25+~cs10.2.23-1
Source reference: /affected/1/versions
8.5.26+~cs10.2.24-1
Source reference: /affected/1/versions
8.5.28+~cs10.2.24-1
Source reference: /affected/1/versions
8.5.6+~cs9.3.28-1
Source reference: /affected/1/versions
8.5.8+~cs9.3.30-1
Source reference: /affected/1/versions
8.5.9+~cs9.3.30-1
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

node-postcss

Source reference: /affected/2/package/name

Affected versions: 8.4.49+~cs9.2.32-1
Source reference: /affected/2/versions
8.5.6+~cs9.3.28-1
Source reference: /affected/2/versions
8.5.8+~cs9.3.30-1
Source reference: /affected/2/versions
8.5.9+~cs9.3.30-1
Source reference: /affected/2/versions
Fixed versions: 8.5.12+~cs9.3.32-1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "node-postcss",
      "purl": "pkg:deb/debian/node-postcss?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "8.4.20+~cs8.0.23-1",
      "8.4.20+~cs8.0.23-1+deb12u1",
      "8.4.31+~cs8.0.26-1",
      "8.4.39+~cs9.2.29-1",
      "8.4.49+~cs9.2.32-1",
      "8.5.12+~cs9.3.32-1",
      "8.5.14+~cs9.3.34-1",
      "8.5.15+~cs9.3.34-1",
      "8.5.15+~cs9.3.38-1",
      "8.5.15+~cs9.3.39-1",
      "8.5.19+~cs10.2.23-1",
      "8.5.21+~cs10.2.23-1",
      "8.5.23+~cs10.2.23-1",
      "8.5.25+~cs10.2.23-1",
      "8.5.26+~cs10.2.24-1",
      "8.5.28+~cs10.2.24-1",
      "8.5.6+~cs9.3.28-1",
      "8.5.8+~cs9.3.30-1",
      "8.5.9+~cs9.3.30-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-45623.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "node-postcss",
      "purl": "pkg:deb/debian/node-postcss?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "8.4.49+~cs9.2.32-1",
      "8.5.12+~cs9.3.32-1",
      "8.5.14+~cs9.3.34-1",
      "8.5.15+~cs9.3.34-1",
      "8.5.15+~cs9.3.38-1",
      "8.5.15+~cs9.3.39-1",
      "8.5.19+~cs10.2.23-1",
      "8.5.21+~cs10.2.23-1",
      "8.5.23+~cs10.2.23-1",
      "8.5.25+~cs10.2.23-1",
      "8.5.26+~cs10.2.24-1",
      "8.5.28+~cs10.2.24-1",
      "8.5.6+~cs9.3.28-1",
      "8.5.8+~cs9.3.30-1",
      "8.5.9+~cs9.3.30-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-45623.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "8.5.12+~cs9.3.32-1"
          }
        ]
      }
    ],
    "package": {
      "name": "node-postcss",
      "purl": "pkg:deb/debian/node-postcss?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "8.4.49+~cs9.2.32-1",
      "8.5.6+~cs9.3.28-1",
      "8.5.8+~cs9.3.30-1",
      "8.5.9+~cs9.3.30-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-45623.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #57695 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 17:24:31 GMT
Publisher date: Mon, 27 Jul 2026 18:16:55 GMT

Read the original announcement