CVE-2026-45623: 
JavaScript vulnerability analysis and mitigation

CVE-2026-45623 is a path traversal and information disclosure vulnerability in PostCSS's PreviousMap class that allows an attacker who controls CSS input to read arbitrary files accessible by the Node.js process and leak their initial content via error messages. It affects all versions of the postcss npm package up to and including 8.5.11, and was fixed in version 8.5.12. The vulnerability was published on July 20, 2026, and added to the GitHub Advisory Database on July 23, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, PostCSS Advisory).

The root cause (CWE-22, CWE-200) lies in lib/previous-map.js, which parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to postcss().process() and passes the unsanitized PATH directly to fs.readFileSync() with no scheme check, allowlist, or traversal guard. The getAnnotationURL function only strips the comment prefix and trims whitespace; loadMap then calls loadFile with the raw attacker-supplied path (e.g., /etc/passwd) or, when opts.from is set, resolves it via path.join(dirname(file), attackerPath) — which does not block .. segments. The file bytes are stored in this.text, and when map.consumer() is called, JSON.parse on non-JSON content produces a V8 SyntaxError whose message embeds the first ~10 bytes of the file. This entire chain executes with PostCSS's default options — no from, no map, no plugins required — making it reachable from any pipeline processing untrusted CSS (GitHub Advisory, PostCSS Advisory).

Successful exploitation yields four distinct primitives: (a) arbitrary file read of any file readable by the Node.js process into server memory; (b) information disclosure of the first ~10 bytes of the targeted file via the JSON.parse SyntaxError message surfaced in logs, HTTP 500 responses, or build output — sufficient to recover SSH key headers, API key prefixes, /etc/passwd records, or /proc/self/environ content; (c) a file-existence oracle with three distinguishable response states enabling host filesystem reconnaissance; and (d) a DoS primitive by targeting /dev/zero, /proc/kcore, or very large files, which causes readFileSync to stall or crash the process. Given PostCSS's hundreds of millions of weekly npm downloads and its use in webpack, Vite, Parcel, Next.js, and Gatsby, the blast radius is extremely broad across CMS theme processors, multi-tenant build farms, and any service that accepts user-supplied CSS (GitHub Advisory, PostCSS Advisory).

1. Identify a target: Find a web application, CMS, build service, or API endpoint that accepts user-supplied CSS and processes it through PostCSS (e.g., theme upload endpoints, live CSS preview features, userstyle processors).
2. Craft malicious CSS — absolute path (no opts.from): Embed a sourceMappingURL comment pointing to a sensitive file:

   a { color: red }
   /*# sourceMappingURL=/etc/passwd */

3. Craft malicious CSS — relative traversal (with opts.from set): If the application sets opts.from to a known path, use .. sequences to escape the base directory:

   a { color: red }
   /*# sourceMappingURL=../../../../../etc/passwd */

4. Submit the CSS: Send the crafted CSS to the target endpoint (e.g., via HTTP POST to a theme upload or CSS processing API).
5. Observe the error response: If the application surfaces PostCSS errors (HTTP 500 body, logs, debug output), the JSON.parse SyntaxError message will contain the first ~10 bytes of the targeted file (e.g., Unexpected token 'r', "root:x:0:0"... is not valid JSON).
6. Use the file-existence oracle: Distinguish between a thrown error (file exists, non-JSON), silent success (file exists, valid JSON), and no error (file absent) to map the host filesystem.
7. Escalate: Use leaked API key prefixes, SSH key headers, or environment variable values to pivot to further compromise of the host or connected services (GitHub Advisory, PostCSS Advisory).

• Logs: Application error logs or HTTP 500 responses containing SyntaxError messages with patterns like Unexpected token '...', "<file-content-prefix>"... is not valid JSON originating from PostCSS processing; repeated PostCSS errors for different file paths in rapid succession suggesting automated scanning.
• Network: Unusual or repeated CSS submission requests (HTTP POST) to theme upload, CSS preview, or style processing endpoints containing /*# sourceMappingURL= comments with absolute paths (e.g., /etc/passwd, /proc/self/environ, ~/.ssh/id_rsa) or .. traversal sequences.
• File System: Evidence of fs.readFileSync calls on sensitive paths (detectable via Node.js filesystem auditing or strace/auditd on Linux) for files outside the application's working directory.
• Process: Node.js process generating ENOENT or SyntaxError exceptions at high frequency correlated with CSS processing activity (GitHub Advisory).

Upgrade postcss to version 8.5.12 or later, which restricts loadFile to only accept paths ending in .map by default and suppresses JSON.parse errors to prevent content leakage via error messages (PostCSS Release). The fix introduces two commits: aaec7b7 (catch and suppress JSON.parse errors) and c64b748 (restrict loadFile to .map-suffixed files unless opts.unsafeMap: true is explicitly set) (Commit aaec7b7, Commit c64b748). As an immediate workaround for applications that cannot upgrade, pass { map: false } as the options argument to postcss().process() when handling untrusted CSS — this is the only configuration that disables the vulnerable code path in unpatched versions. Additionally, ensure PostCSS error messages are never surfaced to end users or external callers.