npm

postcss

Security advisories for postcss, newest first. 4 known, all fixed. If you’re on 8.5.23 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

8.5.32

Advisories

4 · 0 unfixed

Last advisory

3 Aug 2026

Safe from

8.5.23

4 advisories · newest first

MODERATE 3 Aug 2026

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

GHSA-fxqj-rqcc-2cmp · CVE-2026-69153

Affected

< 8.5.23

Fixed in

8.5.23

Published

3 Aug 2026

HIGH7.5 24 Jul 2026

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

GHSA-r28c-9q8g-f849 · CVE-2026-73646

Affected

< 8.5.18

Fixed in

8.5.18

Published

24 Jul 2026

HIGH7.5 23 Jul 2026

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

GHSA-6g55-p6wh-862q · CVE-2026-45623

Affected

< 8.5.12

Fixed in

8.5.12

Published

23 Jul 2026

MODERATE6.1 24 Apr 2026

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

GHSA-qx2v-qp2m-jg93 · CVE-2026-41305

Affected

< 8.5.10

Fixed in

8.5.10

Published

24 Apr 2026

/advisories/npm/postcss/feed.rss

From the GitHub advisory database, via OSV · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →