Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-08-17T15:35:13
postcss: PostCSS: Information disclosure via path traversal in source map auto-loading
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-22
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.
A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted `sourceMappingURL` values in untrusted CSS files. This allows the attacker to disclose sensitive `sourcesContent` from arbitrary `.map` files accessible on the system, leading to information disclosure.
Red Hat Hardened Images
2026-08-04T00:00:00Z
RHSA-2026:50287
prometheus3-13-main-3.13.2-0.2.hum1
Red Hat Hardened Images
2026-08-13T00:00:00Z
RHSA-2026:54520
prometheus3-5-main-3.5.5-0.8.hum1
Red Hat OpenShift Dev Spaces 3.30
2026-09-01T00:00:00Z
RHSA-2026:62260
devspaces/openvsx-rhel9:1787759145
Cost Management On Premise
Not affected
costmanagement/costmanagement-ui-rhel10
Gatekeeper 3
Not affected
gatekeeper/gatekeeper-rhel9
Migration Toolkit for Containers
Affected
rhmtc/openshift-migration-ui-rhel8
Multicluster Engine for Kubernetes
Not affected
multicluster-engine/console-mce-rhel9
Node HealthCheck Operator
Affected
workload-availability/node-healthcheck-must-gather-rhel9
Node HealthCheck Operator
Affected
workload-availability/node-healthcheck-operator-bundle
Node HealthCheck Operator
Affected
workload-availability/node-healthcheck-rhel9-operator
Node HealthCheck Operator
Affected
workload-availability/node-remediation-console-rhel8
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-agentic-console-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-419-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-console-plugin-pf5-rhel9
OpenShift Pipelines
Not affected
openshift-pipelines/pipelines-console-plugin-rhel9
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-hub-ui-rhel8
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-hub-ui-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-operator-bundle
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-rhel9-operator
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp2/system-rhel8
Red Hat Advanced Cluster Management for Kubernetes 2
Affected
rhacm2/console-rhel9
Red Hat Advanced Cluster Management for Kubernetes 2
Not affected
rhacm2/volsync-operator-bundle
Red Hat Advanced Cluster Management for Kubernetes 2
Not affected
rhacm2/volsync-rhel9
Red Hat AMQ Broker 7
Not affected
amq-broker-bin.zip
Red Hat AMQ Broker 7
Not affected
amq-broker-maven-repository.zip
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-26/gateway-rhel9
Red Hat Ansible Automation Platform 2
Not affected
ansible-automation-platform-27/gateway-rhel9
Red Hat Ansible Automation Platform 2
Will not fix
automation-controller
Red Hat Ansible Automation Platform 2
Not affected
automation-eda-controller
Red Hat Ansible Automation Platform 2
Not affected
automation-gateway
Red Hat Ansible Automation Platform 2
Not affected
automation-platform-ui
Red Hat build of Apache Camel for Spring Boot 4
Not affected
rhaf-camel-for-springboot-maven-repository.zip
Red Hat build of Apache Camel for Spring Boot 4
Not affected
rhaf-camel-spring-boot-maven-repository.zip
Red Hat build of Apicurio Registry 3
Affected
apicurio/apicurio-registry-ui-rhel8
Red Hat Build of Keycloak
Not affected
keycloak-operator.redhat-00001.zip
Red Hat Build of Keycloak
Not affected
rhbk-quarkus-dist.zip
Red Hat Build of Podman Desktop
Affected
rh-podman-desktop.git
Red Hat Ceph Storage 4
Affected
rhceph/rhceph-4-dashboard-rhel8
Red Hat Ceph Storage 6
Not affected
ceph
Red Hat Ceph Storage 7
Not affected
ceph
Red Hat Ceph Storage 8
Not affected
ceph
Red Hat Ceph Storage 9
Not affected
ceph
Red Hat Ceph Storage 9
Not affected
libarrow
Red Hat Certification Program for Red Hat Enterprise Linux 9
Not affected
redhat-certification-cnf
Red Hat Connectivity Link 1
Not affected
rhcl-1/rhcl-console-plugin-rhel9
Red Hat Data Grid 8
Not affected
redhat-datagrid-maven-repository.zip
Red Hat Developer Hub
Not affected
rhdh/red-hat-developer-hub-backstage-plugin-lightspeed
Red Hat Developer Hub
Not affected
rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend
Red Hat Developer Hub
Not affected
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator
Red Hat Developer Hub
Not affected
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend
Red Hat Developer Hub
Not affected
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki
Red Hat Developer Hub
Not affected
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets
Red Hat Developer Hub
Not affected
rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator
Red Hat Developer Hub
Not affected
rhdh/rhdh-hub-rhel9
Red Hat Discovery 2
Not affected
discovery/discovery-ui-rhel9
Red Hat Enterprise Linux 10
Not affected
ceph
Red Hat Enterprise Linux 10
Not affected
cockpit-image-builder
Red Hat Enterprise Linux 10
Not affected
grafana
Red Hat Enterprise Linux 10
Affected
grafana-pcp
Red Hat Enterprise Linux 10
Affected
qt6-qtbase
Red Hat Enterprise Linux 10
Affected
rh-podman-desktop
Red Hat Enterprise Linux 7
Affected
subscription-manager
Red Hat Enterprise Linux 8
Affected
grafana
Red Hat Enterprise Linux 8
Affected
grafana-pcp
Red Hat Enterprise Linux 8
Not affected
mozjs60
Red Hat Enterprise Linux 8
Not affected
pcs
Red Hat Enterprise Linux 8
Not affected
rust-toolset:rhel8/rust
Red Hat Enterprise Linux 9
Not affected
dotnet6.0
Red Hat Enterprise Linux 9
Not affected
dotnet7.0
Red Hat Enterprise Linux 9
Not affected
grafana
Red Hat Enterprise Linux 9
Affected
grafana-pcp
Red Hat Enterprise Linux 9
Not affected
pcs
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/disk-image-cuda-rhel9
Red Hat Fuse 7
Will not fix
postcss
Red Hat Hardened Images
Not affected
grafana12.4
Red Hat Hardened Images
Not affected
grafana13.1
Red Hat Hardened Images
Not affected
grafana13.2
Red Hat Hardened Images
Not affected
jaeger
Red Hat Hardened Images
Not affected
opentelemetry-collector
Red Hat Hardened Images
Not affected
opentelemetry-collector-contrib
Red Hat Hardened Images
Not affected
opentelemetry-collector-k8s
Red Hat Hardened Images
Not affected
qt5-qtbase
Red Hat Hardened Images
Not affected
qt6-qtbase
Red Hat Hardened Images
Not affected
rust
Red Hat JBoss Enterprise Application Platform 7
Will not fix
jboss-eap-full-maven-repository.zip
Red Hat JBoss Enterprise Application Platform 7
Will not fix
jboss-eap-incremental-maven-repository.zip
Red Hat JBoss Enterprise Application Platform 7
Will not fix
jboss-eap-maven-repository.zip
Red Hat JBoss Enterprise Application Platform 7
Will not fix
jboss-eap-patch.zip
Red Hat JBoss Enterprise Application Platform 7
Will not fix
jboss-eap-runtime-maven-repository.zip
Red Hat JBoss Enterprise Application Platform 8
Not affected
jboss-eap.1-runtime-maven-repository.zip
Red Hat JBoss Enterprise Application Platform 8
Not affected
jboss-eap-runtime-maven-repository.zip
Red Hat JBoss Enterprise Application Platform Expansion Pack
Not affected
jboss-eap.1-runtime-maven-repository.zip
Red Hat JBoss Enterprise Application Platform Expansion Pack
Not affected
jboss-eap-runtime-maven-repository.zip
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-feature-server-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-console
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-console-rhel9
Red Hat Openshift Data Foundation 4
Affected
odf4/ocs-client-console-rhel9
Red Hat Openshift Data Foundation 4
Affected
odf4/odf-console-rhel9
Red Hat Openshift Data Foundation 4
Affected
odf4/odf-multicluster-console-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/code-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/dashboard-rhel9
Red Hat OpenShift GitOps
Affected
microshift-gitops
Red Hat OpenShift GitOps
Not affected
openshift-gitops-argocd-cli
Red Hat Quay 3
Not affected
quay/quay-rhel8
Red Hat Quay 3
Not affected
quay/quay-rhel9
Red Hat Satellite 6
Affected
satellite/iop-advisor-frontend-rhel9
Red Hat Satellite 6
Affected
satellite/iop-host-inventory-frontend-rhel9
Red Hat Satellite 6
Affected
satellite/iop-vulnerability-frontend-rhel9
Red Hat Satellite 6
Not affected
tfm-rubygem-rabl
Red Hat Single Sign-On 7
Affected
postcss
Red Hat Trusted Artifact Signer
Affected
rhtas/rekor-search-ui-rhel9
Red Hat Trusted Artifact Signer
Affected
rhtas/rhtas-console-ui-rhel9
Secrets Management Console for Red Hat OpenShift
Will not fix
external-secrets-management/console-plugin-rhel9
Self-service automation portal 2
Not affected
ansible-automation-platform/automation-portal
https://www.cve.org/CVERecord?id=CVE-2026-73646
https://nvd.nist.gov/vuln/detail/CVE-2026-73646
https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c
https://github.com/postcss/postcss/releases/tag/8.5.18
https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849