CVE-2026-73646

Name	CVE-2026-73646
Description	PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-postcss (PTS)	bullseye	8.2.1+~cs5.3.23-8	vulnerable
	bullseye (security)	8.2.1+~cs5.3.23-8+deb11u1	vulnerable
	bookworm	8.4.20+~cs8.0.23-1+deb12u1	vulnerable
	trixie	8.4.49+~cs9.2.32-1	vulnerable
	forky	8.5.25+~cs10.2.23-1	fixed
	sid	8.5.26+~cs10.2.24-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-postcss	source	(unstable)	8.5.19+~cs10.2.23-1

Notes

https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849
Fixed by: https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c (8.5.18)