CVE-2026-69153CWE-200CWE-22path-traversalinformation-disclosure

CVE-2026-69153

Medium · published August 3, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00451 · 38.2th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-03T21:16Z
Affected products (1)
ProductVersionsFixed in
postcss/postcss< 8.5.238.5.23
References (4)
https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8 · [email protected]https://github.com/postcss/postcss/releases/tag/8.5.19 · [email protected]https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp · [email protected]https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 AUG 16:56Z
    PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
    cvelistv5