CVE-2026-45623 Overview
CVE-2026-45623 is a path traversal vulnerability in PostCSS, a widely used CSS transformation library that parses CSS into an Abstract Syntax Tree. Versions 8.5.11 and prior contain a flaw in the PreviousMap component that parses /*# sourceMappingURL=PATH */ comments from any CSS string passed to process(). The library dereferences the supplied path against the local filesystem without scheme validation, allowlist, or traversal checks. Attackers who control CSS input can force the host process to read arbitrary files accessible to Node.js. The issue affects any pipeline processing untrusted CSS and is fixed in version 8.5.12.
Critical Impact
Attackers can read arbitrary files on the host, leak the first ~10 bytes of file content through JSON.parse error messages, and use the flaw as a file-existence oracle or DoS primitive.
Affected Products
- PostCSS versions 8.5.11 and prior
- Applications processing untrusted CSS through PostCSS (CMS themes, user-uploaded styles)
- Build pipelines, browser-extension processors, and blog comment renderers using PostCSS
Discovery Timeline
- 2026-07-27 - CVE-2026-45623 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-45623
Vulnerability Analysis
The vulnerability resides in PostCSS's source map handling logic. When process() is called on a CSS string, the PreviousMap module scans for the /*# sourceMappingURL=PATH */ annotation and attempts to load the referenced path. The code performs no validation on the URL scheme, no allowlist enforcement, and no directory traversal checks before invoking filesystem reads.
An attacker-supplied CSS payload can therefore reference arbitrary absolute or relative paths. When the file is read, PostCSS attempts to parse the content as JSON. If the content is not valid JSON, the resulting SyntaxError message from JSON.parse includes the first ~10 bytes of the file, which the attacker can extract from the error output.
The flaw also produces a reliable file-existence oracle based on whether errors reference a missing file or a parse failure. Targeting large files creates a denial-of-service condition by exhausting memory or CPU during the read and parse operations. This behavior is CWE-22: Improper Limitation of a Pathname to a Restricted Directory.
Root Cause
The PreviousMap constructor treats the sourceMappingURL value as trusted input. It resolves the path against the local filesystem and reads the referenced file without validating that the path is a data: URI, a permitted location, or free of traversal sequences such as ../.
Attack Vector
The attack requires only that untrusted CSS reach a PostCSS process() call with default options. No from option, no map option, and no plugins are required to trigger the flaw. Any application accepting user-provided styles, third-party theme content, or upstream package CSS is reachable. See the PostCSS GitHub Security Advisory (GHSA-6g55-p6wh-862q) for technical details.
Detection Methods for CVE-2026-45623
Indicators of Compromise
- CSS inputs containing /*# sourceMappingURL= pointing to non-data: URIs, absolute filesystem paths, or paths containing ../ sequences
- Node.js process logs showing JSON.parseSyntaxError messages referencing sensitive filesystem paths such as /etc/passwd or .env files
- Unexpected filesystem read activity from Node.js build or rendering processes correlating with CSS processing events
Detection Strategies
- Inspect CSS content in inbound uploads and stored templates for sourceMappingURL comments that dereference non-inline paths
- Enable auditd or equivalent syscall monitoring on Node.js worker processes to flag unexpected open() calls to system files
- Review application error logs for JSON.parse failures containing filesystem path fragments
Monitoring Recommendations
- Baseline the set of files that PostCSS build processes normally read and alert on deviations
- Correlate CSS ingestion events with subsequent filesystem access patterns in observability tooling
- Track PostCSS package versions across CI/CD and production nodes to identify unpatched instances
How to Mitigate CVE-2026-45623
Immediate Actions Required
- Upgrade PostCSS to version 8.5.12 or later across all applications, build pipelines, and transitive dependencies
- Audit package-lock.json and yarn.lock files to confirm the patched version resolves for every dependency graph entry
- Restrict Node.js process filesystem permissions so PostCSS workers cannot read secrets, credentials, or configuration files
Patch Information
The maintainers released the fix in PostCSS 8.5.12. Refer to the PostCSS GitHub Security Advisory GHSA-6g55-p6wh-862q for full remediation guidance and commit references.
Workarounds
- Strip or reject /*# sourceMappingURL=... */ comments from untrusted CSS before invoking postcss.process()
- Run PostCSS in a sandboxed process or container with minimal filesystem access and no exposure to secrets
- Preprocess untrusted CSS with a validator that rejects source map annotations referencing non-data: URIs
# Upgrade PostCSS to the patched release
npm install postcss@^8.5.12
# Verify the resolved version across the dependency tree
npm ls postcss
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
