{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-45623/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["postcss (\u003c= 8.5.11)"],"_cs_severities":["high"],"_cs_tags":["file-read","information-disclosure","supply-chain","nodejs","web-application","vulnerability","cve-2026-45623"],"_cs_type":"advisory","_cs_vendors":["PostCSS"],"content_html":"\u003cp\u003eA critical vulnerability, tracked as CVE-2026-45623, has been identified in PostCSS, a widely used CSS processing tool. The vulnerability resides within the \u003ccode\u003ePreviousMap\u003c/code\u003e component, specifically affecting versions up to 8.5.11. Attackers can exploit this by embedding specially crafted \u003ccode\u003e/*# sourceMappingURL=PATH */\u003c/code\u003e comments into CSS input that is subsequently processed by \u003ccode\u003epostcss().process()\u003c/code\u003e. The \u003ccode\u003ePreviousMap\u003c/code\u003e component dereferences the \u003ccode\u003ePATH\u003c/code\u003e value against the local filesystem without proper sanitization, allowing for arbitrary file reads, including files like \u003ccode\u003e/etc/passwd\u003c/code\u003e or sensitive environment configuration. This can lead to the disclosure of the first approximately 10 bytes of targeted files through \u003ccode\u003eJSON.parse\u003c/code\u003e \u003ccode\u003eSyntaxError\u003c/code\u003e messages, a file-existence oracle, and potential denial of service by reading large or special device files. The flaw is triggered with PostCSS's default options, making any application that processes untrusted CSS vulnerable, including CMS themes, user-uploaded styles, and various build pipelines.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious CSS string containing a \u003ccode\u003e/*# sourceMappingURL=PATH */\u003c/code\u003e comment, where \u003ccode\u003ePATH\u003c/code\u003e specifies an arbitrary file on the target system (e.g., \u003ccode\u003e/etc/passwd\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe malicious CSS input is provided to a system that processes it using PostCSS's \u003ccode\u003eprocess()\u003c/code\u003e function, often within web applications, build tools, or user content rendering engines.\u003c/li\u003e\n\u003cli\u003ePostCSS's \u003ccode\u003eInput\u003c/code\u003e constructor (within \u003ccode\u003elib/input.js\u003c/code\u003e) is instantiated and, during its initialization, it attempts to load a source map using the \u003ccode\u003ePreviousMap\u003c/code\u003e component.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ePreviousMap\u003c/code\u003e constructor calls \u003ccode\u003eloadAnnotation\u003c/code\u003e to extract the \u003ccode\u003ePATH\u003c/code\u003e from the CSS comment without any sanitization or validation of the provided URL.\u003c/li\u003e\n\u003cli\u003eSubsequently, \u003ccode\u003eloadMap\u003c/code\u003e is invoked. If \u003ccode\u003eopts.from\u003c/code\u003e is unset, the raw attacker-supplied absolute path is used. If \u003ccode\u003eopts.from\u003c/code\u003e is set, \u003ccode\u003epath.join\u003c/code\u003e is used, which does not block \u003ccode\u003e..\u003c/code\u003e segments, enabling path traversal to arbitrary locations like \u003ccode\u003e../../../../../etc/passwd\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eloadFile\u003c/code\u003e function is called with the attacker-controlled or traversed file path, which then performs a synchronous file read using \u003ccode\u003ereadFileSync(path, 'utf-8')\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe read file content is then processed. If the content is not valid JSON (which is typical for files like \u003ccode\u003e/etc/passwd\u003c/code\u003e), \u003ccode\u003eSourceMapConsumer\u003c/code\u003e attempts to call \u003ccode\u003eJSON.parse\u003c/code\u003e, resulting in a \u003ccode\u003eSyntaxError\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eSyntaxError\u003c/code\u003e message, which includes the first ~10 bytes of the file content (e.g., \u0026quot;Unexpected token 'r', \u0026quot;root:x:0:0\u0026quot;...\u0026quot;), is propagated back to the application, disclosing sensitive information to the attacker.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for an arbitrary file read of any file accessible by the Node.js process, impacting the confidentiality of sensitive data across a wide range of applications. The initial ~10 bytes leaked from the targeted file through the \u003ccode\u003eJSON.parse\u003c/code\u003e \u003ccode\u003eSyntaxError\u003c/code\u003e message are often sufficient to reveal critical information, such as SSH key headers, prefixes of API keys (\u003ccode\u003eAPI_KEY=sk...\u003c/code\u003e), \u003ccode\u003e/etc/passwd\u003c/code\u003e entries, or parts of process environment variables (\u003ccode\u003e/proc/self/environ\u003c/code\u003e). This information can be used for further exploitation. Additionally, the flaw provides a file-existence oracle, enabling attackers to map out filesystem structures and confirm the presence of specific files or configurations. A denial of service (DoS) can also be achieved by directing \u003ccode\u003ereadFileSync\u003c/code\u003e to large files or special device files like \u003ccode\u003e/dev/zero\u003c/code\u003e, potentially stalling or crashing the application. Given PostCSS's extensive use in web development ecosystems, this vulnerability poses a significant risk to any system processing untrusted CSS.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch \u003ccode\u003enpm/postcss\u003c/code\u003e immediately\u003c/strong\u003e to a version greater than 8.5.11 to mitigate CVE-2026-45623.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAudit application logging and error handling\u003c/strong\u003e to ensure that PostCSS error messages (specifically \u003ccode\u003eSyntaxError\u003c/code\u003e messages resulting from \u003ccode\u003eJSON.parse\u003c/code\u003e) are not exposed to untrusted users. These errors can contain fragments of sensitive file contents.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImplement input validation and sanitization\u003c/strong\u003e for all CSS input processed by PostCSS, especially in environments where user-supplied or untrusted CSS is handled. Block or strip \u003ccode\u003e/*# sourceMappingURL=\u003c/code\u003e comments from untrusted sources if possible.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eConfigure PostCSS with \u003ccode\u003e{ map: false }\u003c/code\u003e\u003c/strong\u003e in scenarios where previous source map handling is not required, as this explicitly disables the vulnerable functionality and is the only full short-circuit for the bug.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T15:10:37Z","date_published":"2026-07-23T15:10:37Z","id":"https://feed.craftedsignal.io/briefs/2026-07-postcss-file-read/","summary":"A high-severity vulnerability (CVE-2026-45623) in PostCSS's `PreviousMap` component allows attackers to perform arbitrary file reads and information disclosure from the local filesystem by injecting malicious `sourceMappingURL` comments into untrusted CSS input, leading to sensitive data leakage and denial of service.","title":"PostCSS: Arbitrary File Read and Information Disclosure via sourceMappingURL","url":"https://feed.craftedsignal.io/briefs/2026-07-postcss-file-read/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-45623","version":"https://jsonfeed.org/version/1.1"}