# CVE-2026-45623: PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

> CVE-2026-45623: PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments. CVSS 7.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-45623
Last updated: 2026-08-07T00:13:41Z

- Published: 2026-07-27 17:23 UTC · Updated: 2026-08-07 00:13 UTC · Assigner: GitHub\_M
- CVSS: 7.5 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS: 0.61%, 49th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-200, CWE-22

## Description

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /\*\# sourceMappingURL=PATH \*/ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.

## Affected vendors and products

- postcss: postcss

## Tracked companies

- [Confluence](https://rewindex.com/company/confluence.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-45623)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-45623)
- [https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q](https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-45623 · Markdown: https://rewindex.com/cve/CVE-2026-45623.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-45623 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:13:13.507Z