Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N U H N H 9.1 .0061 46.5 —
AFFECTED
Product Versions Fixed
postcss < 8.5.12 – —
TIMELINE
May 12 Reserved by GitHub_M
Jul 27 EXPLOIT PUBLISHED — CVE-2026-45623 (postcss). Public exploit reference added.
Jul 27 Published (CNA: GitHub_M)
Description
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| May 12, 2026 | Reserved | Reserved by GitHub_M |
| July 27, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-45623 (postcss). Public exploit reference added. |
| July 27, 2026 | Published | Published (CNA: GitHub_M) |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| postcss | postcss | — | < 8.5.12 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-45623 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.