Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-27T17:23:13 postcss: PostCSS: Information disclosure and denial of service via crafted CSS input 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-22

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.

A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifically the first few bytes of file content. Additionally, this vulnerability may be exploited to cause a Denial of Service (DoS) by targeting large files, making the system unavailable.

Red Hat Advanced Cluster Management for Kubernetes 2.15 2026-08-12T00:00:00Z RHSA-2026:54427 rhacm2/console-rhel9:1786547771 Cryostat 4 Under investigation cryostat-openshift-console-plugin-npm Cryostat 4 Under investigation grafana-infinity-datasource-npm Cryostat 4 Under investigation postcss Gatekeeper 3 Not affected gatekeeper/gatekeeper-rhel9 Migration Toolkit for Containers Affected rhmtc/openshift-migration-ui-rhel8 Multicluster Engine for Kubernetes Affected multicluster-engine/console-mce-rhel9 Node HealthCheck Operator Affected workload-availability/node-healthcheck-must-gather-rhel9 Node HealthCheck Operator Affected workload-availability/node-healthcheck-operator-bundle Node HealthCheck Operator Affected workload-availability/node-healthcheck-rhel9-operator OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-agentic-console-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-console-plugin-419-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-console-plugin-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-rhel8 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-hub-ui-rhel8 OpenShift Pipelines Affected openshift-pipelines/pipelines-hub-ui-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-operator-bundle OpenShift Service Mesh 3 Affected openshift-service-mesh/kiali-ossmc-rhel9 OpenShift Service Mesh 3 Affected openshift-service-mesh/kiali-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-rhel9-operator Red Hat 3scale API Management Platform 2 Under investigation 3scale-amp2/system-rhel7 Red Hat Advanced Cluster Management for Kubernetes 2 Will not fix rhacm2/volsync-operator-bundle Red Hat Advanced Cluster Management for Kubernetes 2 Will not fix rhacm2/volsync-rhel9 Red Hat AMQ Broker 7 Under investigation postcss Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/gateway-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-27/gateway-rhel9 Red Hat Ansible Automation Platform 2 Affected automation-eda-controller Red Hat Ansible Automation Platform 2 Affected automation-gateway Red Hat Ansible Automation Platform 2 Affected automation-platform-ui Red Hat build of Apache Camel for Spring Boot 4 Under investigation postcss Red Hat build of Apache Camel - HawtIO 4 Under investigation postcss Red Hat build of Apicurio Registry 3 Under investigation apicurio/apicurio-registry-ui-rhel8 Red Hat Build of Keycloak Under investigation postcss Red Hat Build of Podman Desktop Affected rh-podman-desktop.git Red Hat Connectivity Link 1 Under investigation rhcl-1/rhcl-console-plugin-rhel9 Red Hat Data Grid 8 Under investigation postcss Red Hat Developer Hub Affected rhdh/rhdh-hub-rhel9 Red Hat Discovery 2 Affected discovery/discovery-ui-rhel9 Red Hat Enterprise Linux 10 Affected firefox Red Hat Enterprise Linux 10 Affected goose Red Hat Enterprise Linux 10 Affected grafana Red Hat Enterprise Linux 10 Affected thunderbird Red Hat Enterprise Linux 7 Affected subscription-manager Red Hat Enterprise Linux 8 Affected firefox Red Hat Enterprise Linux 8 Affected grafana Red Hat Enterprise Linux 8 Not affected mozjs60 Red Hat Enterprise Linux 8 Not affected pcs Red Hat Enterprise Linux 8 Affected thunderbird Red Hat Enterprise Linux 9 Affected firefox Red Hat Enterprise Linux 9 Not affected gjs Red Hat Enterprise Linux 9 Affected goose Red Hat Enterprise Linux 9 Affected grafana Red Hat Enterprise Linux 9 Not affected pcs Red Hat Enterprise Linux 9 Affected thunderbird Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/disk-image-cuda-rhel9 Red Hat Hardened Images Not affected opentelemetry-collector Red Hat Hardened Images Not affected opentelemetry-collector-contrib Red Hat Hardened Images Not affected prometheus3.13 Red Hat Hardened Images Not affected prometheus3.5 Red Hat Hardened Images Not affected qt5-qtbase Red Hat Hardened Images Not affected qt6-qtbase Red Hat Hardened Images Not affected rust Red Hat JBoss Enterprise Application Platform 7 Under investigation postcss Red Hat JBoss Enterprise Application Platform 8 Under investigation postcss Red Hat JBoss Enterprise Application Platform Expansion Pack Under investigation postcss Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-console Red Hat OpenShift Container Platform 4 Affected openshift4/ose-console-rhel9 Red Hat Openshift Data Foundation 4 Under investigation odf4/ocs-client-console-rhel9 Red Hat Openshift Data Foundation 4 Under investigation odf4/odf-console-rhel9 Red Hat Openshift Data Foundation 4 Under investigation odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/code-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/dashboard-rhel9 Red Hat OpenShift Dev Spaces Affected devspaces/openvsx-rhel9 Red Hat OpenShift Virtualization 4 Not affected container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Quay 3 Not affected quay/quay-rhel8 Red Hat Quay 3 Not affected quay/quay-rhel9 Red Hat Satellite 6 Affected nodejs-css-loader Red Hat Satellite 6 Affected nodejs-sanitize-html Red Hat Satellite 6 Affected satellite/iop-advisor-frontend-rhel9 Red Hat Satellite 6 Affected satellite/iop-host-inventory-frontend-rhel9 Red Hat Satellite 6 Affected satellite/iop-vulnerability-frontend-rhel9 Red Hat Single Sign-On 7 Under investigation postcss Red Hat Trusted Artifact Signer Affected rhtas/rekor-search-ui-rhel9 Red Hat Trusted Artifact Signer Affected rhtas/rhtas-console-ui-rhel9 Secrets Management Console for Red Hat OpenShift Will not fix external-secrets-management/console-plugin-rhel9 Self-service automation portal 2 Affected ansible-automation-platform/automation-portal streams for Apache Kafka 2 Under investigation postcss streams for Apache Kafka 3 Under investigation postcss https://www.cve.org/CVERecord?id=CVE-2026-45623 https://nvd.nist.gov/vuln/detail/CVE-2026-45623 https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q