CVE-2026-73646: 
JavaScript vulnerability analysis and mitigation

CVE-2026-73646 is a path traversal vulnerability in PostCSS (CWE-22) that allows an attacker to disclose the contents of arbitrary .map files reachable from the server's filesystem. By embedding a crafted /*# sourceMappingURL=... */ comment in attacker-controlled CSS, the vulnerability causes PostCSS to load and expose source map files — including their sourcesContent — outside the intended directory. All PostCSS versions up to and including 8.5.17 (npm package) are affected; the issue was fixed in version 8.5.18. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause lies in lib/previous-map.js, where loadMap() constructs a candidate file path via join(dirname(opts.from), annotation), using the raw, attacker-controlled sourceMappingURL value from the CSS comment as annotation. Because path.join() normalizes but does not sandbox .. path segments, a traversal prefix (e.g., ../../../../) can walk the resolved path outside the intended directory (GitHub Advisory). When opts.from is not set, the annotation is used completely unmodified, allowing an absolute path in the CSS comment to be read verbatim. A prior partial fix in 8.5.12 restricted readable files to those ending in .map but did not address the traversal itself. Once a .map file is loaded, MapGenerator.isMap() treats it as an implicit request to generate result.map, causing sourcesContent from the traversed file to be returned to the caller (GitHub Commit).

Successful exploitation results in unauthorized disclosure of the contents of arbitrary .map files accessible to the PostCSS process, with high confidentiality impact and no integrity or availability impact. Source map files commonly contain original source code (via sourcesContent), meaning attackers can exfiltrate application source code, configuration snippets, or other sensitive content embedded in build artifacts. Any application that processes untrusted CSS through PostCSS without explicitly passing map: false is affected, and no authentication or user interaction beyond submitting CSS text is required (GitHub Advisory).

The NVD SSVC assessment classifies this vulnerability as having a PoC available and being automatable, meaning exploitation requires no complex setup (GitHub Advisory). The attack is network-accessible, requires no privileges, and no user interaction, making it straightforward to exploit at scale against services that process user-submitted CSS. The EPSS score is currently 0.0, and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing at this time. The vulnerability was reported by iaohkut-from-NightWolf-Team and disclosed via GitHub Security Advisories on July 20, 2026 (GitHub Advisory).

1. Identify a target service: Find a web application or API that accepts user-submitted CSS and processes it through PostCSS (e.g., a CSS linting, formatting, or transformation endpoint) without passing map: false.
2. Craft malicious CSS: Prepare a CSS payload containing a sourceMappingURL comment with a path traversal sequence pointing to a target .map file, e.g.:

   a { color: red; }
   /*# sourceMappingURL=../../../../some/other/app/dist/bundle.js.map */

   If opts.from is not set by the service, use an absolute path instead: /*# sourceMappingURL=/etc/app/dist/bundle.js.map */.
3. Submit the CSS: Send the crafted CSS to the target endpoint via HTTP POST or the relevant API mechanism.
4. Retrieve the source map output: Collect the result.map output returned by the service (e.g., written alongside the output CSS, returned in an API response, or served as a static asset).
5. Extract sensitive content: Parse the returned source map JSON and read the sourcesContent array, which will contain the verbatim contents of the traversed .map file, potentially including original application source code (GitHub Advisory).

• Network: Unusual HTTP requests to CSS processing endpoints containing sourceMappingURL comments with ../ sequences or absolute paths in the CSS body; responses from those endpoints containing unexpectedly large or structured JSON source map data.
• File System: Access log entries (OS-level audit logs) showing the PostCSS process reading .map files outside the application's CSS/upload directory, particularly in directories belonging to other applications or build artifacts.
• Logs: Application or web server logs showing repeated CSS processing requests with payloads containing sourceMappingURL= followed by traversal sequences (../, ../../, or absolute paths like /app/dist/).
• Process: The Node.js process running PostCSS performing unexpected file reads (detectable via strace, auditd, or similar OS-level file access monitoring) on .map files outside the expected working directory (GitHub Advisory).

Upgrade PostCSS to version 8.5.18 or later, which constrains source map loading to .map files within the same directory as opts.from, preventing path traversal (GitHub Release, GitHub Commit). If an immediate upgrade is not possible, pass map: false explicitly in all postcss().process() or postcss.parse() calls that handle untrusted CSS — this is the only confirmed workaround for unpatched versions. The new unsafeMap: true option in 8.5.18 can be used to restore the previous (unsafe) behavior if required for specific trusted use cases, but should not be used when processing untrusted input (GitHub Advisory).

The vulnerability was reported by a researcher from NightWolf-Team (iaohkut-from-NightWolf-Team) and disclosed through GitHub's coordinated security advisory process. The PostCSS maintainer (Andrey Sitnik) released the fix promptly in version 8.5.18 on July 12, 2026, with the advisory published July 20, 2026. The release notes explicitly describe the security restriction and introduce the unsafeMap escape hatch for trusted use cases (GitHub Release).