CVE-2026-73646

About vulnerability

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.

Affected product:

AlmaLinux 9.2 ESU , AngularJS , Next.js , Node.js , React , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Vue , amp-toolbox , angular-build , angular-devkit-build-angular , angular-pwa , assetgraph , astro , astrojs-react , autoprefixer , babel-plugin-react-css-modules , babel-plugin-remove-graphql-queries , babel-preset-expo , beasties , beasties-webpack-plugin , bufbuild/connect-es , chialab-es-dev-server , chialab-es-test-runner , chialab-esbuild-plugin-any-file , chialab-esbuild-plugin-env , chialab-esbuild-plugin-postcss , chialab-node-resolve , chialab-postcss-dart-sass , chialab-rna , chialab-rna-browser-test-runner , chialab-rna-config-loader , chialab-rna-dev-server , chialab-rna-logger , chialab-rna-node-test-runner , chialab-rna-saucelabs-test-runner , chialab-wds-plugin-hmr , chialab-wds-plugin-legacy , chialab-wds-plugin-node-resolve , chialab-wds-plugin-polyfill , chialab-wds-plugin-rna , chialab-wtr-coverage-reporter , chialab-wtr-mocha-reporter , clerk-expo-passkeys , clerk-nextjs , colorable , component-compiler-utils , create-next-app , create-react-app , create-storybook , critters , css-blank-pseudo , css-declaration-sorter , css-has-pseudo , css-loader , css-minimizer-webpack-plugin , css-modules-loader-core , css-prefers-color-scheme , cssnano , cssnano-preset-default , cssnano-preset-simple , cssnano-simple , cssnano-utils , cssstats , csstools-cascade-layer-name-parser , csstools-css-parser-algorithms , csstools-media-query-list-parser , csstools-postcss-bundler , csstools-postcss-cascade-layers , csstools-postcss-color-function , csstools-postcss-content-alt-text , csstools-postcss-design-tokens , csstools-postcss-fit-tolerance-property , csstools-postcss-hwb-function , csstools-postcss-ic-unit , csstools-postcss-initial , csstools-postcss-is-pseudo-class , csstools-postcss-light-dark-function , csstools-postcss-logical-float-and-clear , csstools-postcss-logical-overflow , csstools-postcss-logical-overscroll-behavior , csstools-postcss-logical-resize , csstools-postcss-logical-viewport-units , csstools-postcss-media-queries-aspect-ratio-number-values , csstools-postcss-minify , csstools-postcss-nested-calc , csstools-postcss-oklab-function , csstools-postcss-rebase-url , csstools-postcss-rewrite-url , csstools-postcss-scope-pseudo-class , csstools-postcss-stepped-value-functions , csstools-postcss-text-decoration-shorthand , csstools-postcss-todo-or-die , csstools-postcss-trigonometric-functions , csstools-postcss-unset-value , csstools-selector-specificity , csstools-stylelint-no-invalid-at-import-rules-when-bundling , electron-webpack , epub-maker2 , expo , expo-app-integrity , expo-asset , expo-auth-session , expo-background-fetch , expo-blur , expo-config , expo-constants , expo-crypto , expo-dev-client , expo-dev-launcher , expo-dev-menu , expo-dev-menu-interface , expo-dev-server , expo-dev-tools , expo-electron-adapter , expo-error-recovery , expo-expo-cli , expo-file-system , expo-font , expo-gl , expo-haptics , expo-image , expo-image-utils , expo-intent-launcher , expo-keep-awake , expo-linear-gradient , expo-linking , expo-local-build-cache-provider , expo-manifests , expo-mesh-gradient , expo-metro-config , expo-modules-core , expo-modules-jsi , expo-modules-test-core , expo-navigation-bar , expo-network , expo-network-addons , expo-next-adapter , expo-prebuild-config , expo-print , expo-pwa , expo-router , expo-router-server , expo-screen-capture , expo-sharing , expo-splash-screen , expo-sqlite , expo-standard-web-crypto , expo-status-bar , expo-symbols , expo-system-ui , expo-task-manager , expo-template-bare-minimum , expo-template-blank , expo-template-blank-typescript , expo-template-default , expo-template-tabs , expo-updates , expo-updates-interface , expo-vector-icons , expo-web-browser , expo-webpack-config , expo-widgets , expo-xdl , expo-yarn-workspaces , gatsby , gatsby-cypress , gatsby-interface , gatsby-plugin-compile-es6-packages , gatsby-plugin-emotion , gatsby-plugin-fathom , gatsby-plugin-feed , gatsby-plugin-google-gtag , gatsby-plugin-guess-js , gatsby-plugin-less , gatsby-plugin-manifest , gatsby-plugin-netlify , gatsby-plugin-no-sourcemaps , gatsby-plugin-offline , gatsby-plugin-page-creator , gatsby-plugin-postcss , gatsby-plugin-preact , gatsby-plugin-preload-fonts , gatsby-plugin-react-helmet , gatsby-plugin-schema-snapshot , gatsby-plugin-sitemap , gatsby-plugin-styletron , gatsby-plugin-subfont , gatsby-plugin-typography , gatsby-react-router-scroll , gatsby-remark-code-repls , gatsby-remark-embed-snippet , gatsby-remark-prismjs , gatsby-remark-responsive-iframe , gatsby-source-contentful , gatsby-source-drupal , gatsby-source-filesystem , gatsby-source-graphql , gatsby-source-shopify , gatsby-source-wordpress , gatsby-transformer-react-docgen , gatsby-transformer-remark , gatsby-transformer-sqip , gatsby-transformer-toml , htmlnano , icss-utils , infima , jest-expo , jest-expo-enzyme , jovidecroock-prefresh , ledger-cosmos-js , ledger-live , ledgerhq-coin-cosmos , ledgerhq-coin-polkadot , ledgerhq-hw-app-near , ledgerhq-hw-transport , ledgerhq-hw-transport-mocker , ledgerhq-hw-transport-node-hid-noevents , ledgerhq-hw-transport-node-speculos , ledgerhq-hw-transport-web-ble , ledgerhq-hw-transport-webusb , ledgerhq-live-cli , ledgerhq-live-common , ledgerhq-live-countervalues , lit-labs-nextjs , livestore , livestore-webmesh , material-ui , mdx , module-federation-nextjs-mf , mqify , mui-codemod , mui-docs , mui-icons-material , mui-material , mui-material-nextjs , mui-material-pigment-css , node-pixrem , novel-epub , npm:gatsby-theme-blog-core , nuxt , optimize-css-assets-webpack-plugin , orama-orama , panda , pandacss-core , pandacss-dev , pandacss-generator , pandacss-mcp , pandacss-node , pandacss-parser , pandacss-postcss , pandacss-reporter , pandacss-types , parcel-bundler , patch-project , perfectionist , pigment-css , pleeease-filters , postcss , postcss-apply , postcss-attribute-case-insensitive , postcss-browser-comments , postcss-calc , postcss-charset , postcss-class-postfix , postcss-class-prefix , postcss-class-repeat , postcss-clean , postcss-color-function , postcss-color-functional-notation , postcss-color-gray , postcss-color-hex-alpha , postcss-color-hsl , postcss-color-hwb , postcss-color-mod-function , postcss-color-rebeccapurple , postcss-color-rgb , postcss-color-rgba-fallback , postcss-colormin , postcss-conditionals , postcss-convert-values , postcss-css-variables , postcss-cssnext , postcss-custom-media , postcss-custom-selectors , postcss-dir-pseudo-class , postcss-discard-comments , postcss-discard-duplicates , postcss-discard-empty , postcss-discard-overridden , postcss-discard-unused , postcss-each , postcss-env-function , postcss-extend-rule , postcss-filter-plugins , postcss-flexbugs-fixes , postcss-focus-visible , postcss-focus-within , postcss-font-family-system-ui , postcss-font-variant , postcss-for , postcss-functions , postcss-gap-properties , postcss-icss , postcss-image-set-function , postcss-image-set-polyfill , postcss-import , postcss-initial , postcss-loader , postcss-logical , postcss-media-minmax , postcss-merge-idents , postcss-merge-longhand , postcss-merge-rules , postcss-minify-font-values , postcss-minify-gradients , postcss-minify-params , postcss-minify-selectors , postcss-modules , postcss-modules-extract-imports , postcss-modules-local-by-default , postcss-modules-scope , postcss-modules-values , postcss-nested , postcss-nesting , postcss-normalize , postcss-normalize-display-values , postcss-normalize-positions , postcss-normalize-repeat-style , postcss-normalize-string , postcss-normalize-timing-functions , postcss-normalize-unicode , postcss-normalize-url , postcss-normalize-whitespace , postcss-ordered-values , postcss-overflow-shorthand , postcss-page-break , postcss-place , postcss-plugins , postcss-pseudo-class-any-link , postcss-pseudoelements , postcss-reduce-idents , postcss-reduce-initial , postcss-replace-overflow-wrap , postcss-rtl , postcss-safe-parser , postcss-scss , postcss-selector-matches , postcss-selector-not , postcss-simple-vars , postcss-single-charset , postcss-strip-inline-comments , postcss-svgo , postcss-unique-selectors , postcss-url , postcss-zindex , probe.gl , purgecss , query , resolve-url-loader , rna , rtlcss , rushstack , rushstack-heft-isolated-typescript-transpile-plugin , rushstack-heft-sass-plugin , rushstack-heft-web-rig , sanitize-html , sanity-next-loader , sb , sentry-nextjs , solana-wallet-adapter-example , storybook , storybook-addon-a11y , storybook-addon-docs , storybook-addon-links , storybook-addon-onboarding , storybook-addon-pseudo-states , storybook-addon-themes , storybook-addon-vitest , storybook-angular , storybook-angular-vite , storybook-builder-webpack5 , storybook-cli , storybook-codemod , storybook-core , storybook-core-server , storybook-core-webpack , storybook-ember , storybook-experimental-nextjs-vite , storybook-html , storybook-html-vite , storybook-nextjs , storybook-nextjs-vite , storybook-preact , storybook-preset-create-react-app , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-react , storybook-react-dom-shim , storybook-react-native-web-vite , storybook-react-vite , storybook-react-webpack5 , storybook-server , storybook-server-webpack5 , storybook-svelte , storybook-tanstack-react , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , stylehacks , subfont , svgr , svgr-babel-plugin-add-jsx-attribute , svgr-babel-plugin-remove-jsx-empty-expression , svgr-babel-plugin-replace-jsx-attribute-value , svgr-babel-plugin-svg-em-dimensions , svgr-babel-plugin-transform-react-native-svg , svgr-babel-plugin-transform-svg-component , svgr-babel-preset , svgr-core , svgr-hast-util-to-babel-ast , svgr-plugin-jsx , svgr-plugin-prettier , svgr-plugin-svgo , tachyons-build-css , tachyons-generator , tailwindcss , tanstack-angular-query-experimental , tanstack-eslint-plugin-query , tanstack-query-async-storage-persister , tanstack-query-broadcast-client-experimental , tanstack-query-persist-client-core , tanstack-query-sync-storage-persister , tanstack-react-query-devtools , tanstack-react-query-next-experimental , tanstack-react-query-persist-client , tanstack-solid-query , tanstack-solid-query-devtools , tanstack-solid-query-persist-client , tanstack-svelte-query , tanstack-svelte-query-devtools , tanstack-svelte-query-persist-client , tanstack-vue-query , theme-ui , uncss , vite , vite-plugin-basic-ssl , vite-plugin-beasties , vite-plugin-storybook-nextjs , vitefu , xdl

Affected packages:

create-next-app @ 12.3.7 (+4581 more)