Skip to content
Threat Feed
Subscribe

Tag

Postcss

1 brief RSS
high advisory

PostCSS Path Traversal Vulnerability via Source Map Auto-Loading

A path traversal vulnerability (GHSA-r28c-9q8g-f849) in PostCSS versions up to 8.5.17 allows an unauthenticated attacker to disclose arbitrary `.map` file contents from a vulnerable server by crafting a `sourceMappingURL` comment in user-submitted CSS, leading to sensitive information exposure if the processed output is returned.

PostCSS path-traversal information-disclosure nodejs ghsa
2t