CVE-2026-69153: PostCSS Path Traversal Vulnerability

CVE-2026-69153 Overview

CVE-2026-69153 is a path traversal vulnerability [CWE-22] in PostCSS, a widely used Node.js library that transforms CSS files into an Abstract Syntax Tree for analysis and modification. When the from option is unset, an attacker can craft a sourceMappingURL containing an absolute path or directory-traversal sequence. This causes PreviousMap.loadFile() to read an unintended source-map file from the filesystem. The resulting map's sources and sourcesContent fields may then be exposed to the calling application. The issue affects PostCSS versions prior to 8.5.19 and is fixed in version 8.5.19.

Critical Impact
An attacker who can supply CSS input to a PostCSS-based build or transformation pipeline can trigger reads of arbitrary .map files on disk, potentially exposing sensitive source code or configuration data through the returned AST.

Affected Products

PostCSS versions prior to 8.5.19
Node.js applications and build tools depending on postcss
CSS processing pipelines that accept untrusted CSS without setting the from option

Discovery Timeline

2026-08-03 - CVE-2026-69153 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-69153

Vulnerability Analysis

PostCSS parses CSS input and honors sourceMappingURL comments to load associated source maps. The PreviousMap.loadFile() function in lib/previous-map.js is responsible for resolving and reading the referenced map file. When the caller does not supply the from option (which anchors the CSS file's location), the guard that restricts sourceMappingURL to relative paths within the CSS file's directory does not apply as intended.

An attacker who controls the CSS content can embed a sourceMappingURL referencing an absolute path or a ../-prefixed traversal sequence. PostCSS then reads that file and exposes its sources and sourcesContent through the parsed AST. Applications that surface these fields, such as build dashboards or diagnostic endpoints, may leak sensitive filesystem content to the requester.

Root Cause

The root cause is missing validation of the sourceMappingURL path when the from option is unset. Without a base file (cssFile), the existing relative-path check in loadFile() is bypassed, allowing absolute paths and traversal segments to reach existsSync() and the subsequent file read.

Attack Vector

Exploitation requires the attacker to supply CSS input to an application that invokes PostCSS without setting from. The attacker embeds a crafted sourceMappingURL comment. When the resulting map data is reflected back to the attacker or made accessible through application output, sensitive on-disk content is disclosed.

javascript

// Security patch in lib/previous-map.js
// Refuses to load a source map when opts.from (cssFile) is not provided
 loadFile(path, cssFile, trusted) {
   if (!trusted && !this.unsafeMap) {
     if (!/\.map$/i.test(path)) return undefined
     if (!cssFile) return undefined

     let rel = relative(dirname(cssFile), path)
     if (rel === '..' || rel.startsWith('..' + sep) || isAbsolute(rel)) {
       return undefined
     }
   }
   this.root = dirname(path)
   if (existsSync(path)) {

Source: PostCSS commit 7beca13

The patch adds an explicit early return when cssFile is falsy, closing the case where from is unset. It also tightens the extension check to reject non-.map targets before any filesystem access.

Detection Methods for CVE-2026-69153

Indicators of Compromise

CSS payloads containing sourceMappingURL comments with absolute paths (for example, /etc/, C:\) or ../ traversal sequences
Application logs showing PostCSS reads of .map files outside the expected project directory
Unexpected file access events from Node.js processes running PostCSS against user-controlled CSS

Detection Strategies

Inventory all direct and transitive uses of postcss in package manifests and lockfiles, flagging versions below 8.5.19
Inspect application code for PostCSS invocations that omit the from option when processing external or user-supplied CSS
Review web application logs for HTTP responses containing source map sources or sourcesContent fields that reference sensitive filesystem paths

Monitoring Recommendations

Monitor Node.js process file access telemetry for reads of .map files outside expected project roots
Alert on outbound responses from build or CSS-processing services that contain filesystem paths uncharacteristic of the application
Track dependency updates in CI to ensure PostCSS remains at 8.5.19 or later

How to Mitigate CVE-2026-69153

Immediate Actions Required

Upgrade postcss to version 8.5.19 or later across all applications and build pipelines
Audit all PostCSS call sites and set the from option to the source CSS file path
Do not process untrusted CSS input without validating or stripping sourceMappingURL comments

Patch Information

The fix is available in PostCSS 8.5.19. See the GitHub Release v8.5.19, the GitHub Security Advisory GHSA-fxqj-rqcc-2cmp, and the GitHub Commit Changes for the code change in lib/previous-map.js.

Workarounds

Always pass an explicit from option to postcss.process() so the relative-path check in loadFile() applies
Disable inline source map loading by setting the map option to false or { prev: false } in PostCSS configuration when handling untrusted CSS
Sanitize CSS input to remove /*# sourceMappingURL=... */ comments before passing content to PostCSS

bash

# Upgrade PostCSS to the patched version
npm install postcss@^8.5.19

# Verify installed version across the dependency tree
npm ls postcss