Attack Chain

1. An attacker crafts a malicious CSS string containing a /*# sourceMappingURL=PATH */ comment, where PATH specifies an arbitrary file on the target system (e.g., /etc/passwd).
2. The malicious CSS input is provided to a system that processes it using PostCSS's process() function, often within web applications, build tools, or user content rendering engines.
3. PostCSS's Input constructor (within lib/input.js) is instantiated and, during its initialization, it attempts to load a source map using the PreviousMap component.
4. The PreviousMap constructor calls loadAnnotation to extract the PATH from the CSS comment without any sanitization or validation of the provided URL.
5. Subsequently, loadMap is invoked. If opts.from is unset, the raw attacker-supplied absolute path is used. If opts.from is set, path.join is used, which does not block .. segments, enabling path traversal to arbitrary locations like ../../../../../etc/passwd.
6. The loadFile function is called with the attacker-controlled or traversed file path, which then performs a synchronous file read using readFileSync(path, 'utf-8').
7. The read file content is then processed. If the content is not valid JSON (which is typical for files like /etc/passwd), SourceMapConsumer attempts to call JSON.parse, resulting in a SyntaxError.
8. The SyntaxError message, which includes the first ~10 bytes of the file content (e.g., "Unexpected token 'r', "root:x:0:0"..."), is propagated back to the application, disclosing sensitive information to the attacker.

Impact

The vulnerability allows for an arbitrary file read of any file accessible by the Node.js process, impacting the confidentiality of sensitive data across a wide range of applications. The initial ~10 bytes leaked from the targeted file through the JSON.parse SyntaxError message are often sufficient to reveal critical information, such as SSH key headers, prefixes of API keys (API_KEY=sk...), /etc/passwd entries, or parts of process environment variables (/proc/self/environ). This information can be used for further exploitation. Additionally, the flaw provides a file-existence oracle, enabling attackers to map out filesystem structures and confirm the presence of specific files or configurations. A denial of service (DoS) can also be achieved by directing readFileSync to large files or special device files like /dev/zero, potentially stalling or crashing the application. Given PostCSS's extensive use in web development ecosystems, this vulnerability poses a significant risk to any system processing untrusted CSS.

Recommendation

• Patch npm/postcss immediately to a version greater than 8.5.11 to mitigate CVE-2026-45623.
• Audit application logging and error handling to ensure that PostCSS error messages (specifically SyntaxError messages resulting from JSON.parse) are not exposed to untrusted users. These errors can contain fragments of sensitive file contents.
• Implement input validation and sanitization for all CSS input processed by PostCSS, especially in environments where user-supplied or untrusted CSS is handled. Block or strip /*# sourceMappingURL= comments from untrusted sources if possible.
• Configure PostCSS with { map: false } in scenarios where previous source map handling is not required, as this explicitly disables the vulnerable functionality and is the only full short-circuit for the bug.