Skip to content
Threat Feed
Subscribe

Vendor

PostCSS

1 brief RSS
high advisory

PostCSS: Arbitrary File Read and Information Disclosure via sourceMappingURL

A high-severity vulnerability (CVE-2026-45623) in PostCSS's `PreviousMap` component allows attackers to perform arbitrary file reads and information disclosure from the local filesystem by injecting malicious `sourceMappingURL` comments into untrusted CSS input, leading to sensitive data leakage and denial of service.

postcss file-read information-disclosure supply-chain nodejs web-application vulnerability cve-2026-45623
3t