Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-08-03T16:56:25
postcss: PostCSS: Information disclosure via crafted sourceMappingURL
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-22
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application's source code.
Red Hat rates this flaw as Moderate because the information disclosed is limited to files with a .map extension. Source map files may contain source code paths and content, but the attacker cannot read arbitrary files on the system. Exploitation requires the application to process attacker-controlled CSS through PostCSS on the server side.
Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely.
Red Hat Hardened Images
2026-08-04T00:00:00Z
RHSA-2026:50070
prometheus3-5-main-3.5.5-0.7.hum1
Red Hat Hardened Images
2026-08-04T00:00:00Z
RHSA-2026:50079
grafana13-1-main-13.1.1-0.5.1.hum1
Red Hat Hardened Images
2026-08-04T00:00:00Z
RHSA-2026:50287
prometheus3-13-main-3.13.2-0.2.hum1
Red Hat Hardened Images
2026-08-04T00:00:00Z
RHSA-2026:50290
grafana12-4-main-12.4.6-0.4.hum1
Red Hat Hardened Images
2026-08-05T00:00:00Z
RHSA-2026:50826
grafana13-1-main-13.1.1-0.5.2.hum1
Cryostat 4
Affected
cryostat-openshift-console-plugin-npm
Cryostat 4
Affected
grafana-infinity-datasource-npm
Cryostat 4
Affected
postcss
Gatekeeper 3
Not affected
gatekeeper/gatekeeper-rhel9
Migration Toolkit for Containers
Affected
rhmtc/openshift-migration-ui-rhel8
Multicluster Engine for Kubernetes
Affected
multicluster-engine/console-mce-rhel9
Node HealthCheck Operator
Affected
workload-availability/node-healthcheck-must-gather-rhel9
Node HealthCheck Operator
Affected
workload-availability/node-healthcheck-operator-bundle
Node HealthCheck Operator
Affected
workload-availability/node-healthcheck-rhel9-operator
OpenShift Lightspeed
Affected
openshift-lightspeed/lightspeed-agentic-console-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-419-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-rhel9
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-console-plugin-pf5-rhel9
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-console-plugin-rhel8
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-console-plugin-rhel9
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-hub-ui-rhel8
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-hub-ui-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-operator-bundle
OpenShift Service Mesh 3
Affected
openshift-service-mesh/kiali-ossmc-rhel9
OpenShift Service Mesh 3
Affected
openshift-service-mesh/kiali-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-rhel9-operator
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp2/system-rhel7
Red Hat Advanced Cluster Management for Kubernetes 2
Affected
rhacm2/console-rhel9
Red Hat Advanced Cluster Management for Kubernetes 2
Will not fix
rhacm2/volsync-operator-bundle
Red Hat Advanced Cluster Management for Kubernetes 2
Will not fix
rhacm2/volsync-rhel9
Red Hat AMQ Broker 7
Affected
postcss
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform-26/gateway-rhel9
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform-27/gateway-rhel9
Red Hat Ansible Automation Platform 2
Affected
automation-eda-controller
Red Hat Ansible Automation Platform 2
Affected
automation-gateway
Red Hat Ansible Automation Platform 2
Affected
automation-platform-ui
Red Hat build of Apache Camel for Spring Boot 4
Not affected
postcss
Red Hat build of Apache Camel - HawtIO 4
Affected
postcss
Red Hat build of Apicurio Registry 3
Affected
apicurio/apicurio-registry-ui-rhel8
Red Hat Build of Keycloak
Affected
postcss
Red Hat Build of Podman Desktop
Affected
rh-podman-desktop.git
Red Hat Connectivity Link 1
Affected
rhcl-1/rhcl-console-plugin-rhel9
Red Hat Data Grid 8
Affected
postcss
Red Hat Developer Hub
Affected
rhdh/red-hat-developer-hub-backstage-plugin-lightspeed
Red Hat Developer Hub
Not affected
rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend
Red Hat Developer Hub
Not affected
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator
Red Hat Developer Hub
Not affected
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend
Red Hat Developer Hub
Not affected
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki
Red Hat Developer Hub
Not affected
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets
Red Hat Developer Hub
Not affected
rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator
Red Hat Developer Hub
Affected
rhdh/rhdh-hub-rhel9
Red Hat Discovery 2
Affected
discovery/discovery-ui-rhel9
Red Hat Edge Manager 1
Affected
flightctl
Red Hat Enterprise Linux 10
Affected
firefox
Red Hat Enterprise Linux 10
Affected
goose
Red Hat Enterprise Linux 10
Not affected
grafana
Red Hat Enterprise Linux 10
Affected
thunderbird
Red Hat Enterprise Linux 7
Affected
subscription-manager
Red Hat Enterprise Linux 8
Affected
firefox
Red Hat Enterprise Linux 8
Not affected
grafana
Red Hat Enterprise Linux 8
Not affected
mozjs60
Red Hat Enterprise Linux 8
Affected
pcs
Red Hat Enterprise Linux 8
Affected
thunderbird
Red Hat Enterprise Linux 9
Affected
firefox
Red Hat Enterprise Linux 9
Not affected
gjs
Red Hat Enterprise Linux 9
Affected
goose
Red Hat Enterprise Linux 9
Not affected
grafana
Red Hat Enterprise Linux 9
Affected
pcs
Red Hat Enterprise Linux 9
Affected
thunderbird
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/disk-image-cuda-rhel9
Red Hat Hardened Images
Not affected
jaeger
Red Hat Hardened Images
Not affected
opentelemetry-collector
Red Hat Hardened Images
Not affected
opentelemetry-collector-contrib
Red Hat Hardened Images
Not affected
opentelemetry-collector-k8s
Red Hat Hardened Images
Not affected
qt5-qtbase
Red Hat Hardened Images
Not affected
qt6-qtbase
Red Hat Hardened Images
Not affected
rust
Red Hat JBoss Enterprise Application Platform 7
Not affected
postcss
Red Hat JBoss Enterprise Application Platform 8
Affected
postcss
Red Hat JBoss Enterprise Application Platform Expansion Pack
Not affected
postcss
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mlflow-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-console
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-console-rhel9
Red Hat Openshift Data Foundation 4
Will not fix
odf4/ocs-client-console-rhel9
Red Hat Openshift Data Foundation 4
Affected
odf4/odf-console-rhel9
Red Hat Openshift Data Foundation 4
Will not fix
odf4/odf-multicluster-console-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/code-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/dashboard-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/openvsx-rhel9
Red Hat OpenShift Virtualization 4
Not affected
container-native-virtualization/kubevirt-console-plugin-rhel9
Red Hat Quay 3
Affected
quay/quay-rhel8
Red Hat Quay 3
Affected
quay/quay-rhel9
Red Hat Satellite 6
Not affected
nodejs-css-loader
Red Hat Satellite 6
Not affected
nodejs-sanitize-html
Red Hat Satellite 6
Not affected
satellite/iop-advisor-frontend-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-host-inventory-frontend-rhel9
Red Hat Satellite 6
Not affected
satellite/iop-vulnerability-frontend-rhel9
Red Hat Single Sign-On 7
Affected
postcss
Red Hat Trusted Artifact Signer
Affected
rhtas/rekor-search-ui-rhel9
Red Hat Trusted Artifact Signer
Affected
rhtas/rhtas-console-ui-rhel9
Secrets Management Console for Red Hat OpenShift
Will not fix
external-secrets-management/console-plugin-rhel9
Self-service automation portal 2
Affected
ansible-automation-platform/automation-portal
streams for Apache Kafka 2
Affected
postcss
streams for Apache Kafka 3
Affected
postcss
https://www.cve.org/CVERecord?id=CVE-2026-69153
https://nvd.nist.gov/vuln/detail/CVE-2026-69153
https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8
https://github.com/postcss/postcss/releases/tag/8.5.19
https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp