Description

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T16:17:47.257Z",
  "pubdate": "2026-08-17T16:17:47.257Z",
  "executiveSummary": "A vulnerability exists in PostCSS prior to version 8.5.18 that allows an attacker to achieve arbitrary file disclosure of sourcesContent from reachable .map files. The vulnerability stems from insecure handling of attacker-controlled sourceMappingURL values and lack of validation in map file loading routines. When untrusted CSS is processed without explicitly setting map: false, the application may inadvertently read and expose sensitive data contained within arbitrary source map files to the output result.map. The impact of this security flaw involves the unauthorized extraction of source code and internal file contents, potentially revealing sensitive application logic or credentials. Attackers capable of supplying malicious CSS payloads to the parsing engine can trigger this behavior remotely. Remediation requires upgrading the PostCSS package to version 8.5.18 or higher.",
  "technicalDetails": "The vulnerability resides within the source map handling logic of PostCSS, specifically in the lib/previous-map.js file. The root cause is twofold: first, the loadMap() function passes attacker-controlled sourceMappingURL values directly into a path joining operation expressed as join(dirname(opts.from), annotation); second, the loadFile() function permits path traversal sequences as well as absolute .map file paths without proper sanitization or restriction.\nDuring standard execution, when PostCSS processes a CSS file and processes source maps, it evaluates the sourceMappingURL annotation found within the stylesheet. If the parsing operation is executed without explicitly disabling source map processing via the map: false configuration option, the vulnerable loadMap() and loadFile() functions attempt to resolve and read the referenced map file from the underlying filesystem.\nBecause the sourceMappingURL value is attacker-controlled and lacks adequate validation, an attacker can supply directory traversal sequences or absolute paths pointing to sensitive files on the filesystem. The lib/previous-map.js component resolves these manipulated paths and reads the target file contents during the Abstract Syntax Tree transformation and map parsing phase.\nThe exploitation flow begins when an attacker provides maliciously crafted CSS containing a crafted sourceMappingURL pointing to an arbitrary .map file or system resource. Upon processing this input, PostCSS reads the target file and incorporates the retrieved contents, specifically the sourcesContent field, into the resulting result.map object. The sensitive file contents are subsequently disclosed back to the caller or processing pipeline.\nThe affected component is lib/previous-map.js within the PostCSS ecosystem for versions prior to 8.5.18. Exploitation does not require authentication or elevated privileges, provided the application processes untrusted CSS inputs with default or insecure map configurations over an accessible network interface."
}