{"items":[{"id":"NVI-00016254","kind":"vulnerability","title":"PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6g55-p6wh-862q","CVE-2026-45623"],"plain_summary":"GitHub lists this reviewed advisory for postcss. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-57301835c51b59d04459ef7cc5a67b3d"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-23T15:06:17.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-57301835c51b59d04459ef7cc5a67b3d"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-57301835c51b59d04459ef7cc5a67b3d","url":"https://github.com/advisories/GHSA-6g55-p6wh-862q","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-6g55-p6wh-862q","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T17:42:43.803Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-57301835c51b59d04459ef7cc5a67b3d"],"technology":"postcss","known_exclusions":[],"conditions_summary":"## Summary\n\nPostCSS's `PreviousMap` parses the `/*# sourceMappingURL=PATH */` comment from any CSS string passed to `process()` and dereferences `PATH` against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting `JSON.parse` `SyntaxError` message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no `from`, no `map`, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.).\n\n## Details\n\nThe dangerous chain lives in `lib/previous-map.js` and is wired into every `Input` construction at `lib/input.js:70-77`.\n\n`Input` constructor (`lib/input.js:70-77`):\n\n```js\nif (pathAvailable && sourceMapAvailable) {\n  let map = new PreviousMap(this.css, opts)\n  if (map.text) {\n   ","public_affected_ranges":["<= 8.5.11"]}],"null_published_at":"2026-11-04T10:04:27.924Z","source_updated_at":"2026-07-23T15:06:17.000Z","source_disclosed_at":"2026-07-23T15:06:16.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T17:42:43.803Z"}],"next_cursor":null,"snapshot_revision":"42594"}