Medium severity5.3NVD Advisory· Published Aug 3, 2026· Updated Aug 5, 2026
CVE-2026-69153
CVE-2026-69153
Description
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
postcssnpm | < 8.5.23 | 8.5.23 |
Affected products
38- Package: https://npmjs.com/package/postcss
- osv-coords35 versionspkg:apk/chainguard/arangodb-3.11pkg:apk/chainguard/arangodb-3.12pkg:apk/chainguard/authentik-2025.12pkg:apk/chainguard/authentik-2026.2pkg:apk/chainguard/authentik-2026.5pkg:apk/chainguard/authentik-fips-2026.5pkg:apk/chainguard/cadence-webpkg:apk/chainguard/gitlab-rails-ce-19.3pkg:apk/chainguard/gitlab-rails-ce-fips-19.3pkg:apk/chainguard/keep-uipkg:apk/chainguard/keep-ui-fipspkg:apk/chainguard/kubeflow-pipelines-frontendpkg:apk/chainguard/langfuse-3-workerpkg:apk/chainguard/langfuse-4-workerpkg:apk/chainguard/langfuse-fips-3-workerpkg:apk/chainguard/langfuse-fips-4-workerpkg:apk/chainguard/nextcloud-server-31pkg:apk/chainguard/nextcloud-server-32pkg:apk/chainguard/nextcloud-server-33pkg:apk/chainguard/nextcloud-server-34pkg:apk/chainguard/pelias-apipkg:apk/chainguard/renovatepkg:apk/chainguard/safpkg:apk/chainguard/semaphorepkg:apk/chainguard/vitess-23pkg:apk/chainguard/vitess-24pkg:apk/wolfi/kubeflow-pipelines-frontendpkg:apk/wolfi/langfuse-3-workerpkg:apk/wolfi/nextcloud-server-32pkg:apk/wolfi/nextcloud-server-33pkg:apk/wolfi/renovatepkg:apk/wolfi/safpkg:apk/wolfi/vitess-23pkg:apk/wolfi/vitess-24pkg:rpm/opensuse/agama-web-ui&distro=openSUSE%20Tumbleweed
< 3.11.14.5-r1+ 34 more
- (no CPE)range: < 3.11.14.5-r1
- (no CPE)range: < 3.12.9.4-r22
- (no CPE)range: < 2025.12.6-r6
- (no CPE)range: < 2026.2.6-r11
- (no CPE)range: < 2026.5.6-r3
- (no CPE)range: < 2026.5.6-r3
- (no CPE)range: < 4.0.16-r6
- (no CPE)range: < 19.3.1-r6
- (no CPE)range: < 19.3.1-r3
- (no CPE)range: < 0.54.2-r2
- (no CPE)range: < 0.54.2-r4
- (no CPE)range: < 2.17.0-r3
- (no CPE)range: < 3.225.1-r2
- (no CPE)range: < 4.6.0-r0
- (no CPE)range: < 3.225.1-r2
- (no CPE)range: < 4.4.0-r0
- (no CPE)range: < 31.0.14-r6
- (no CPE)range: < 32.0.13-r4
- (no CPE)range: < 33.0.8-r1
- (no CPE)range: < 34.0.2-r7
- (no CPE)range: < 7.8.0-r7
- (no CPE)range: < 44.11.4-r0
- (no CPE)range: < 1.6.0-r4
- (no CPE)range: < 2.18.29-r3
- (no CPE)range: < 23.0.5-r7
- (no CPE)range: < 24.0.2-r10
- (no CPE)range: < 2.17.0-r3
- (no CPE)range: < 3.225.1-r2
- (no CPE)range: < 32.0.13-r4
- (no CPE)range: < 33.0.8-r1
- (no CPE)range: < 44.11.4-r0
- (no CPE)range: < 1.6.0-r4
- (no CPE)range: < 23.0.5-r7
- (no CPE)range: < 24.0.2-r10
- (no CPE)range: < 24+0.a836cced5-52.1
Patches
Vulnerability mechanics
References
4- github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8nvdPatchWEB
- github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmpnvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-fxqj-rqcc-2cmpghsaADVISORY
- github.com/postcss/postcss/releases/tag/8.5.19nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.