{"id":"CVE-2026-41305","aliases":["CLSA-2026-1779065184","CLSA-2026-1779065188","CLSA-2026-1779065191","CLSA-2026-1779065192","CLSA-2026-1779065193","CLSA-2026-1779065198","CLSA-2026-1779324473","CLSA-2026-1779670117","CLSA-2026-1783991047","CLSA-2026-1783991051","CLSA-2026-1784943315","CLSA-2026-1790604941","CLSA-2026-1791633202","CLSA-2026-1791806458","CLSA-2026-1791806570","CLSA-2026-1792160907","CLSA-2026-1792160954","CLSA-2026-1792160960","CLSA-2026-1792161450","CLSA-2026-1792161451","CLSA-2026-1792161483","CLSA-2026-1792161588","CLSA-2026-1792161590","CLSA-2026-1792161591","CLSA-2026-1792161813","CLSA-2026-1792161926","CLSA-2026-1793099909","CLSA-2026-1793099949","CLSA-2026-1793706695","CLSA-2026-1793707849","DEBIAN-CVE-2026-41305","EUVD-2026-25383","GHSA-qx2v-qp2m-jg93","GHSA-rq7w-g337-39qq","ROOT-APP-NPM-CVE-2026-41305","UBUNTU-CVE-2026-41305"],"status":"published","title":"PostCSS has XSS via Unescaped \u003c/style\u003e in its CSS Stringify Output","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `\u003c/style\u003e` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `\u003cstyle\u003e` tags, `\u003c/style\u003e` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00205,"percentile":0.10538,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-79"],"published":"2026-04-24T02:27:47Z","modified":"2026-11-10T19:45:16Z","fixes":[{"ecosystem":"npm","package":"postcss","fixed_in":["8.5.10"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"nuxt","fixed_in":["4.4.7"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"postcss","fixed_in":["8.4.41-tuxcare.1","8.4.31-tuxcare.1","8.5.6-tuxcare.1","8.5.2-tuxcare.3","8.5.3-tuxcare.3","8.5.5-tuxcare.2","8.4.33-tuxcare.3","8.4.17-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"nuxt","fixed_in":["3.12.4-tuxcare.7","3.12.3-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","fixed_in":["3.12.4-tuxcare.7","3.12.3-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/kit","fixed_in":["3.12.4-tuxcare.7","3.12.3-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/schema","fixed_in":["3.12.4-tuxcare.7","3.12.3-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","fixed_in":["3.12.3-tuxcare.4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-postcss","fixed_in":["8.5.12+~cs9.3.32-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"postcss","fixed_in":["8.5.8-aikido.2","8.5.6-aikido.2","8.5.3-aikido.3","8.5.3-aikido.1","8.5.9-aikido.1","8.4.31-aikido.1","5.2.18-aikido.3","7.0.39-aikido.4","8.5.6-aikido.3","7.0.39-aikido.5","8.5.8-aikido.3","8.5.8-aikido.4","8.4.31-aikido.2","8.5.9-aikido.2","7.0.39-aikido.6","5.2.18-aikido.4","8.5.3-aikido.2","8.5.9-aikido.3","8.5.6-aikido.4","7.0.39-aikido.7","8.5.8-aikido.5","5.2.18-aikido.5","8.5.6-aikido.5","8.4.31-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/postcss","fixed_in":["8.5.6-root.io.2","8.5.8-root.io.2","8.5.6-root.io.1","8.5.8-root.io.1","8.5.9-root.io.1","8.5.3-root.io.1","8.5.3-root.io.3","8.4.31-root.io.1","5.2.18-root.io.3","7.0.39-root.io.4","8.5.6-root.io.3","7.0.39-root.io.5","8.5.8-root.io.3","8.5.8-root.io.4","8.4.31-root.io.2","8.5.9-root.io.2","7.0.39-root.io.6","5.2.18-root.io.4","8.5.3-root.io.2","8.5.9-root.io.3","8.5.6-root.io.4","7.0.39-root.io.7","8.5.8-root.io.5","5.2.18-root.io.5","8.5.6-root.io.5","8.4.31-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.10"}]}]},{"source":"ghsa","ecosystem":"npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-alpha.1"},{"fixed":"4.4.7"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.41-tuxcare.0"},{"fixed":"8.4.41-tuxcare.1"}]}],"versions":["8.4.41"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.15-tuxcare.0"},{"fixed":"8.2.15-tuxcare.1"}]}],"versions":["8.2.15"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.31-tuxcare.0"},{"fixed":"8.4.31-tuxcare.1"}]}],"versions":["8.4.31"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.6-tuxcare.0"},{"fixed":"8.5.6-tuxcare.1"}]}],"versions":["8.5.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.5-tuxcare.0"},{"fixed":"8.4.5-tuxcare.1"}]}],"versions":["8.4.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.21-tuxcare.0"},{"fixed":"7.0.21-tuxcare.1"}]}],"versions":["7.0.21"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.32-tuxcare.0"},{"fixed":"7.0.32-tuxcare.1"}]}],"versions":["7.0.32"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.17-tuxcare.0"},{"fixed":"7.0.17-tuxcare.1"}]}],"versions":["7.0.17"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.7"}]}],"versions":["3.12.4","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.4","3.12.4-tuxcare.5","3.12.4-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.4"}]}],"versions":["3.12.3","3.12.3-tuxcare.1","3.12.3-tuxcare.2","3.12.3-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.14-tuxcare.0"},{"fixed":"8.4.14-tuxcare.3"}]}],"versions":["8.4.14","8.4.14-tuxcare.1","8.4.14-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.1-tuxcare.0"},{"fixed":"6.0.1-tuxcare.1"}]}],"versions":["6.0.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.49-tuxcare.0"},{"fixed":"8.4.49-tuxcare.1"}]}],"versions":["8.4.49"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.2-tuxcare.0"},{"fixed":"8.5.2-tuxcare.3"}]}],"versions":["8.5.2","8.5.2-tuxcare.1","8.5.2-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.3-tuxcare.0"},{"fixed":"8.5.3-tuxcare.3"}]}],"versions":["8.5.3","8.5.3-tuxcare.1","8.5.3-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.23-tuxcare.0"},{"fixed":"6.0.23-tuxcare.1"}]}],"versions":["6.0.23"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.4"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.7"}]}],"versions":["3.12.4","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.4","3.12.4-tuxcare.5","3.12.4-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.7"}]}],"versions":["3.12.4","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.4"}]}],"versions":["3.12.3","3.12.3-tuxcare.1","3.12.3-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/rspack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.4"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.4"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.7"}]}],"versions":["3.12.4","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.4"}]}],"versions":["3.12.3","3.12.3-tuxcare.1","3.12.3-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.4"}]}],"versions":["3.12.3","3.12.3-tuxcare.1","3.12.3-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.4"}]}],"versions":["3.12.3","3.12.3-tuxcare.1","3.12.3-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.5-tuxcare.0"},{"fixed":"8.5.5-tuxcare.2"}]}],"versions":["8.5.5","8.5.5-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.9-tuxcare.0"},{"fixed":"8.2.9-tuxcare.3"}]}],"versions":["8.2.9","8.2.9-tuxcare.1","8.2.9-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.33-tuxcare.0"},{"fixed":"8.4.33-tuxcare.3"}]}],"versions":["8.4.33","8.4.33-tuxcare.1","8.4.33-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.17-tuxcare.0"},{"fixed":"8.4.17-tuxcare.3"}]}],"versions":["8.4.17","8.4.17-tuxcare.1","8.4.17-tuxcare.2"]},{"source":"osv","ecosystem":"Debian:12","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.20+~cs8.0.23-1","8.4.20+~cs8.0.23-1+deb12u1","8.4.31+~cs8.0.26-1","8.4.39+~cs9.2.29-1","8.4.49+~cs9.2.32-1","8.5.12+~cs9.3.32-1","8.5.14+~cs9.3.34-1","8.5.15+~cs9.3.34-1","8.5.15+~cs9.3.38-1","8.5.15+~cs9.3.39-1","8.5.19+~cs10.2.23-1","8.5.21+~cs10.2.23-1","8.5.23+~cs10.2.23-1","8.5.25+~cs10.2.23-1","8.5.26+~cs10.2.24-1","8.5.28+~cs10.2.24-1","8.5.6+~cs9.3.28-1","8.5.8+~cs9.3.30-1","8.5.9+~cs9.3.30-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.49+~cs9.2.32-1","8.5.12+~cs9.3.32-1","8.5.14+~cs9.3.34-1","8.5.15+~cs9.3.34-1","8.5.15+~cs9.3.38-1","8.5.15+~cs9.3.39-1","8.5.19+~cs10.2.23-1","8.5.21+~cs10.2.23-1","8.5.23+~cs10.2.23-1","8.5.25+~cs10.2.23-1","8.5.26+~cs10.2.24-1","8.5.28+~cs10.2.24-1","8.5.6+~cs9.3.28-1","8.5.8+~cs9.3.30-1","8.5.9+~cs9.3.30-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.12+~cs9.3.32-1"}]}],"versions":["8.4.49+~cs9.2.32-1","8.5.6+~cs9.3.28-1","8.5.8+~cs9.3.30-1","8.5.9+~cs9.3.30-1"]},{"source":"osv","ecosystem":"npm","package":"postcss","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.5.10"}]}]},{"source":"osv","ecosystem":"npm","package":"nuxt","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0-alpha.1"},{"fixed":"4.4.7"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.8-aikido.2"},{"fixed":"8.5.6-aikido.2"},{"fixed":"8.5.3-aikido.3"},{"fixed":"8.5.3-aikido.1"},{"fixed":"8.5.9-aikido.1"},{"fixed":"8.4.31-aikido.1"},{"fixed":"5.2.18-aikido.3"},{"fixed":"7.0.39-aikido.4"},{"fixed":"8.5.6-aikido.3"},{"fixed":"7.0.39-aikido.5"},{"fixed":"8.5.8-aikido.3"},{"fixed":"8.5.8-aikido.4"},{"fixed":"8.4.31-aikido.2"},{"fixed":"8.5.9-aikido.2"},{"fixed":"7.0.39-aikido.6"},{"fixed":"5.2.18-aikido.4"},{"fixed":"8.5.3-aikido.2"},{"fixed":"8.5.9-aikido.3"},{"fixed":"8.5.6-aikido.4"},{"fixed":"7.0.39-aikido.7"},{"fixed":"8.5.8-aikido.5"},{"fixed":"5.2.18-aikido.5"},{"fixed":"8.5.6-aikido.5"},{"fixed":"8.4.31-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-root.io.2"},{"fixed":"8.5.8-root.io.2"},{"fixed":"8.5.6-root.io.1"},{"fixed":"8.5.8-root.io.1"},{"fixed":"8.5.9-root.io.1"},{"fixed":"8.5.3-root.io.1"},{"fixed":"8.5.3-root.io.3"},{"fixed":"8.4.31-root.io.1"},{"fixed":"5.2.18-root.io.3"},{"fixed":"7.0.39-root.io.4"},{"fixed":"8.5.6-root.io.3"},{"fixed":"7.0.39-root.io.5"},{"fixed":"8.5.8-root.io.3"},{"fixed":"8.5.8-root.io.4"},{"fixed":"8.4.31-root.io.2"},{"fixed":"8.5.9-root.io.2"},{"fixed":"7.0.39-root.io.6"},{"fixed":"5.2.18-root.io.4"},{"fixed":"8.5.3-root.io.2"},{"fixed":"8.5.9-root.io.3"},{"fixed":"8.5.6-root.io.4"},{"fixed":"7.0.39-root.io.7"},{"fixed":"8.5.8-root.io.5"},{"fixed":"5.2.18-root.io.5"},{"fixed":"8.5.6-root.io.5"},{"fixed":"8.4.31-root.io.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.23-1","6.0.23-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.2.1+~cs5.3.23-8","8.4.5+~cs7.1.51-2","8.4.6+~cs7.3.21-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.20+~cs8.0.23-1","8.4.31+~cs8.0.26-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.49+~cs9.2.32-1","8.5.6+~cs9.3.28-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.5.8+~cs9.3.30-1","8.5.15+~cs9.3.34-1","8.5.15+~cs9.3.38-1","8.5.15+~cs9.3.39-1build1","8.5.25+~cs10.2.23-1","8.5.26+~cs10.2.24-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.5.6+~cs9.3.28-1","8.5.8+~cs9.3.30-1"]}],"products":[{"vendor":"postcss","product":"postcss"}],"references":[{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.10","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41305","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qx2v-qp2m-jg93"},{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-rq7w-g337-39qq","tags":["web"]},{"url":"https://github.com/nuxt/nuxt/pull/35201","tags":["web"]},{"url":"https://github.com/nuxt/nuxt/commit/55c75b78c989b8bd210837b0e5faaebbf2b87b15","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rq7w-g337-39qq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41305.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41305","tags":["advisory"]},{"url":"https://github.com/postcss/postcss","tags":["package"]},{"url":"https://github.com/nuxt/nuxt","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-41305","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41305","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-41305","title":"PostCSS has XSS via Unescaped \u003c/style\u003e in its CSS Stringify Output","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `\u003c/style\u003e` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `\u003cstyle\u003e` tags, `\u003c/style\u003e` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.","status":"published","published":"2026-04-24T02:27:47.719Z","modified":"2026-04-24T16:23:41.198Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-25383","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `\u003c/style\u003e` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `\u003cstyle\u003e` tags, `\u003c/style\u003e` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.","status":"published","published":"2026-04-24T02:27:47Z","modified":"2026-04-24T16:23:41Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:18.224827Z"}],"ghsa":[{"id":"GHSA-qx2v-qp2m-jg93","title":"PostCSS has XSS via Unescaped \u003c/style\u003e in its CSS Stringify Output","description":"# PostCSS: XSS via Unescaped `\u003c/style\u003e` in CSS Stringify Output\n\n## Summary\n\nPostCSS v8.5.5 (latest) does not escape `\u003c/style\u003e` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `\u003cstyle\u003e` tags, `\u003c/style\u003e` in CSS values breaks out of the style context, enabling XSS.\n\n## Proof of Concept\n\n```javascript\nconst postcss = require('postcss');\n\n// Parse user CSS and re-stringify for page embedding\nconst userCSS = 'body { content: \"\u003c/style\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003cstyle\u003e\"; }';\nconst ast = postcss.parse(userCSS);\nconst output = ast.toResult().css;\nconst html = `\u003cstyle\u003e${output}\u003c/style\u003e`;\n\nconsole.log(html);\n// \u003cstyle\u003ebody { content: \"\u003c/style\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003cstyle\u003e\"; }\u003c/style\u003e\n//\n// Browser: \u003c/style\u003e closes the style tag, \u003cscript\u003e executes\n```\n\n**Tested output** (Node.js v22, postcss v8.5.5):\n```\nInput: body { content: \"\u003c/style\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003cstyle\u003e\"; }\nOutput: body { content: \"\u003c/style\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003cstyle\u003e\"; }\nContains \u003c/style\u003e: true\n```\n\n## Impact\n\nImpact non-bundler use cases since bundlers for XSS on their own. Requires some PostCSS plugin to have malware code, which can inject XSS to website.\n\n## Suggested Fix\n\nEscape `\u003c/style` in all stringified output values:\n```javascript\noutput = output.replace(/\u003c\\/(style)/gi, '\u003c\\\\/$1');\n```\n\n## Credits\nDiscovered and reported by [Sunil Kumar](https://tharvid.in) ([@TharVid](https://github.com/TharVid))","status":"published","published":"2026-04-24T15:31:42Z","modified":"2026-04-24T15:31:44Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:56.453138Z"},{"id":"GHSA-rq7w-g337-39qq","title":"Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`","description":"### Summary\n\nWhen running `nuxt dev`, Nuxt registers an unauthenticated route at `/.well-known/appspecific/com.chrome.devtools.json` that returns the absolute filesystem path of the project root and a per-project UUID persisted to `node_modules/.cache/nuxt/chrome-workspace.json`. The route is enabled by default via `experimental.chromeDevtoolsProjectSettings: true`.\n\nThe endpoint exists to let Chrome DevTools' Workspace integration map sources to the developer's local checkout. The handler is registered directly on `nitro.options.devHandlers` and does not pass through the CORS / origin wrapper that the rest of the dev pipeline uses, so it has no host / origin / `Sec-Fetch-Site` check of its own.\n\n### Impact\n\nDev-server only. Production builds do not register the route.\n\nTwo values are disclosed:\n\n- `workspace.root`: the absolute filesystem path of the project (commonly reveals the OS username and the on-disk project name).\n- `workspace.uuid`: a v4 UUID persisted to `node_modules/.cache/nuxt/chrome-workspace.json`, stable across dev-server restarts and re-clones.\n\n### Threat model\n\nThe response carries no `Access-Control-Allow-Origin` header. A cross-origin `fetch()` from an arbitrary malicious page is therefore blocked by the browser's same-origin policy and cannot read the body. The two realistic recovery paths are:\n\n1. **LAN-adjacent attacker** when the developer runs `nuxt dev --host` (or otherwise binds to a non-loopback interface). A plain `curl http://\u003cdev-lan-ip\u003e:3000/.well-known/appspecific/com.chrome.devtools.json` returns the JSON; no browser, no CORS.\n2. **DNS rebinding** against the default loopback dev server. A page the developer visits resolves to the attacker, then re-resolves to `127.0.0.1` after the TTL; the browser believes the request is same-origin and reads the response.\n\n### Affected versions\n\n`nuxt@4.0.0-alpha.1` (PR #32084) through `nuxt@4.4.6`. `3.x` is not affected.\n\n### Reproduction\n\n```bash\nnpx nuxt dev\ncurl -s http://localhost:3000/.well-known/appspecific/com.chrome.devtools.json\n# {\"workspace\":{\"uuid\":\"...\",\"root\":\"/Users/\u003cname\u003e/...\"}}\n```\n\n### Workaround\n\nSet `experimental: { chromeDevtoolsProjectSettings: false }` in `nuxt.config.ts`. Chrome DevTools' Workspace auto-integration will stop working; the dev server is otherwise unaffected.\n\n### Patches\n\nFixed in `nuxt@4.4.7` by [#35201](https://github.com/nuxt/nuxt/pull/35201) (commit [`55c75b78`](https://github.com/nuxt/nuxt/commit/55c75b78c989b8bd210837b0e5faaebbf2b87b15)). The handler is now routed through the same host / origin gate the rest of the dev server uses, so the endpoint only responds to requests that look local.","status":"published","published":"2026-06-15T20:56:22Z","modified":"2026-06-15T20:56:23Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:40:28.438722Z"}],"nvd":[{"id":"CVE-2026-41305","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `\u003c/style\u003e` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `\u003cstyle\u003e` tags, `\u003c/style\u003e` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.","status":"published","published":"2026-04-24T03:16:11.547Z","modified":"2026-06-17T10:46:28.7Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:15.867234Z"}],"osv":[{"id":"CVE-2026-41305","title":"PostCSS has XSS via Unescaped \u003c/style\u003e in its CSS Stringify Output","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `\u003c/style\u003e` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `\u003cstyle\u003e` tags, `\u003c/style\u003e` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.","status":"published","published":"2026-04-24T02:27:47.719Z","modified":"2026-10-28T02:30:23.160439524Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"DEBIAN-CVE-2026-41305","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `\u003c/style\u003e` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `\u003cstyle\u003e` tags, `\u003c/style\u003e` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.","status":"published","published":"2026-04-24T03:16:11.547Z","modified":"2026-10-01T03:02:45.52890752Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"GHSA-qx2v-qp2m-jg93","title":"PostCSS has XSS via Unescaped \u003c/style\u003e in its CSS Stringify Output","description":"# PostCSS: XSS via Unescaped `\u003c/style\u003e` in CSS Stringify Output\n\n## Summary\n\nPostCSS v8.5.5 (latest) does not escape `\u003c/style\u003e` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `\u003cstyle\u003e` tags, `\u003c/style\u003e` in CSS values breaks out of the style context, enabling XSS.\n\n## Proof of Concept\n\n```javascript\nconst postcss = require('postcss');\n\n// Parse user CSS and re-stringify for page embedding\nconst userCSS = 'body { content: \"\u003c/style\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003cstyle\u003e\"; }';\nconst ast = postcss.parse(userCSS);\nconst output = ast.toResult().css;\nconst html = `\u003cstyle\u003e${output}\u003c/style\u003e`;\n\nconsole.log(html);\n// \u003cstyle\u003ebody { content: \"\u003c/style\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003cstyle\u003e\"; }\u003c/style\u003e\n//\n// Browser: \u003c/style\u003e closes the style tag, \u003cscript\u003e executes\n```\n\n**Tested output** (Node.js v22, postcss v8.5.5):\n```\nInput: body { content: \"\u003c/style\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003cstyle\u003e\"; }\nOutput: body { content: \"\u003c/style\u003e\u003cscript\u003ealert(1)\u003c/script\u003e\u003cstyle\u003e\"; }\nContains \u003c/style\u003e: true\n```\n\n## Impact\n\nImpact non-bundler use cases since bundlers for XSS on their own. Requires some PostCSS plugin to have malware code, which can inject XSS to website.\n\n## Suggested Fix\n\nEscape `\u003c/style` in all stringified output values:\n```javascript\noutput = output.replace(/\u003c\\/(style)/gi, '\u003c\\\\/$1');\n```\n\n## Credits\nDiscovered and reported by [Sunil Kumar](https://tharvid.in) ([@TharVid](https://github.com/TharVid))","status":"published","published":"2026-04-24T15:31:42Z","modified":"2026-09-10T03:51:02.916463871Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"GHSA-rq7w-g337-39qq","title":"Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`","description":"### Summary\n\nWhen running `nuxt dev`, Nuxt registers an unauthenticated route at `/.well-known/appspecific/com.chrome.devtools.json` that returns the absolute filesystem path of the project root and a per-project UUID persisted to `node_modules/.cache/nuxt/chrome-workspace.json`. The route is enabled by default via `experimental.chromeDevtoolsProjectSettings: true`.\n\nThe endpoint exists to let Chrome DevTools' Workspace integration map sources to the developer's local checkout. The handler is registered directly on `nitro.options.devHandlers` and does not pass through the CORS / origin wrapper that the rest of the dev pipeline uses, so it has no host / origin / `Sec-Fetch-Site` check of its own.\n\n### Impact\n\nDev-server only. Production builds do not register the route.\n\nTwo values are disclosed:\n\n- `workspace.root`: the absolute filesystem path of the project (commonly reveals the OS username and the on-disk project name).\n- `workspace.uuid`: a v4 UUID persisted to `node_modules/.cache/nuxt/chrome-workspace.json`, stable across dev-server restarts and re-clones.\n\n### Threat model\n\nThe response carries no `Access-Control-Allow-Origin` header. A cross-origin `fetch()` from an arbitrary malicious page is therefore blocked by the browser's same-origin policy and cannot read the body. The two realistic recovery paths are:\n\n1. **LAN-adjacent attacker** when the developer runs `nuxt dev --host` (or otherwise binds to a non-loopback interface). A plain `curl http://\u003cdev-lan-ip\u003e:3000/.well-known/appspecific/com.chrome.devtools.json` returns the JSON; no browser, no CORS.\n2. **DNS rebinding** against the default loopback dev server. A page the developer visits resolves to the attacker, then re-resolves to `127.0.0.1` after the TTL; the browser believes the request is same-origin and reads the response.\n\n### Affected versions\n\n`nuxt@4.0.0-alpha.1` (PR #32084) through `nuxt@4.4.6`. `3.x` is not affected.\n\n### Reproduction\n\n```bash\nnpx nuxt dev\ncurl -s http://localhost:3000/.well-known/appspecific/com.chrome.devtools.json\n# {\"workspace\":{\"uuid\":\"...\",\"root\":\"/Users/\u003cname\u003e/...\"}}\n```\n\n### Workaround\n\nSet `experimental: { chromeDevtoolsProjectSettings: false }` in `nuxt.config.ts`. Chrome DevTools' Workspace auto-integration will stop working; the dev server is otherwise unaffected.\n\n### Patches\n\nFixed in `nuxt@4.4.7` by [#35201](https://github.com/nuxt/nuxt/pull/35201) (commit [`55c75b78`](https://github.com/nuxt/nuxt/commit/55c75b78c989b8bd210837b0e5faaebbf2b87b15)). The handler is now routed through the same host / origin gate the rest of the dev server uses, so the endpoint only responds to requests that look local.","status":"published","published":"2026-06-15T20:56:22Z","modified":"2026-06-15T21:00:07.676162148Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"ROOT-APP-NPM-CVE-2026-41305","title":"CVE-2026-41305 in postcss - Patched by Root","description":"Root has patched CVE-2026-41305 in the postcss package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-10T04:56:44Z","modified":"2026-09-10T05:15:04.621769524Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"UBUNTU-CVE-2026-41305","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `\u003c/style\u003e` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `\u003cstyle\u003e` tags, `\u003c/style\u003e` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.","status":"published","published":"2026-04-24T03:16:00Z","modified":"2026-10-17T12:58:14.276702748Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"CLSA-2026-1779065184","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.41-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:45:29.063870103Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779065188","title":"TuxCare security update for postcss (2 CVEs)","description":"TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.2.15-tuxcare.1.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-10-15T09:45:28.657574665Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779065191","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.31-tuxcare.1.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-10-15T09:45:29.613450557Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779065192","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.5.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-10-15T09:45:30.22565137Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779065193","title":"TuxCare security update for postcss (2 CVEs)","description":"TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.4.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-10-15T09:45:30.923819868Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779065198","title":"TuxCare security update for postcss (4 CVEs)","description":"TuxCare rebuilt postcss to address 4 CVEs. Fixed in 7.0.21-tuxcare.1.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-10-15T09:45:28.666234919Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779324473","title":"TuxCare security update for postcss (4 CVEs)","description":"TuxCare rebuilt postcss to address 4 CVEs. Fixed in 7.0.32-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:48:03.725144745Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779670117","title":"TuxCare security update for postcss (4 CVEs)","description":"TuxCare rebuilt postcss to address 4 CVEs. Fixed in 7.0.17-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:47:50.219691591Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1783991047","title":"TuxCare security update for nuxt (1 CVE)","description":"TuxCare rebuilt nuxt to address 1 CVE. Fixed in 3.12.4-tuxcare.7.","status":"published","published":"2026-08-04T14:52:43Z","modified":"2026-11-10T19:45:12.854919278Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1783991051","title":"TuxCare security update for nuxt (1 CVE)","description":"TuxCare rebuilt nuxt to address 1 CVE. Fixed in 3.12.3-tuxcare.4.","status":"published","published":"2026-08-04T14:52:43Z","modified":"2026-10-15T09:47:35.046769353Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784943315","title":"TuxCare security update for postcss (2 CVEs)","description":"TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.4.14-tuxcare.3.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-15T09:47:35.707172618Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1790604941","title":"TuxCare security update for postcss (6 CVEs)","description":"TuxCare rebuilt postcss to address 6 CVEs. Fixed in 6.0.1-tuxcare.1.","status":"published","published":"2026-09-28T14:15:41Z","modified":"2026-10-15T09:48:04.060835227Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791633202","title":"TuxCare security update for postcss (4 CVEs)","description":"TuxCare rebuilt postcss to address 4 CVEs. Fixed in 8.4.49-tuxcare.1.","status":"published","published":"2026-10-10T11:53:22Z","modified":"2026-10-15T09:48:04.606976649Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791806458","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.5.2-tuxcare.3.","status":"published","published":"2026-10-12T12:00:58Z","modified":"2026-10-15T09:47:40.190723384Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791806570","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.5.3-tuxcare.3.","status":"published","published":"2026-10-12T12:02:50Z","modified":"2026-10-15T09:47:40.275688207Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792160907","title":"TuxCare security update for postcss (3 CVEs)","description":"TuxCare rebuilt postcss to address 3 CVEs. Fixed in 6.0.23-tuxcare.1.","status":"published","published":"2026-10-16T14:28:26Z","modified":"2026-10-16T16:30:45.074271784Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792160954","title":"TuxCare security update for @nuxt/vite-builder (2 CVEs)","description":"TuxCare rebuilt @nuxt/vite-builder to address 2 CVEs. Fixed in 4.0.3-tuxcare.4.","status":"published","published":"2026-10-16T14:29:10Z","modified":"2026-11-10T19:45:14.295679752Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792160960","title":"TuxCare security update for @nuxt/webpack-builder (1 CVE)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 1 CVE. Fixed in 3.12.4-tuxcare.7.","status":"published","published":"2026-10-16T14:29:16Z","modified":"2026-11-10T19:45:16.404179773Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792161450","title":"TuxCare security update for @nuxt/kit (2 CVEs)","description":"TuxCare rebuilt @nuxt/kit to address 2 CVEs. Fixed in 3.12.4-tuxcare.7.","status":"published","published":"2026-10-16T14:37:30Z","modified":"2026-10-16T16:31:27.018447813Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161451","title":"TuxCare security update for @nuxt/kit (1 CVE)","description":"TuxCare rebuilt @nuxt/kit to address 1 CVE. Fixed in 3.12.3-tuxcare.4.","status":"published","published":"2026-10-16T14:37:31Z","modified":"2026-10-16T16:31:27.024710343Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161483","title":"TuxCare security update for @nuxt/rspack-builder (4 CVEs)","description":"TuxCare rebuilt @nuxt/rspack-builder to address 4 CVEs. Fixed in 4.0.3-tuxcare.4.","status":"published","published":"2026-10-16T14:38:03Z","modified":"2026-11-10T19:45:16.370820957Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792161588","title":"TuxCare security update for @nuxt/schema (2 CVEs)","description":"TuxCare rebuilt @nuxt/schema to address 2 CVEs. Fixed in 4.0.3-tuxcare.4.","status":"published","published":"2026-10-16T14:39:48Z","modified":"2026-11-10T19:45:15.106359209Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792161590","title":"TuxCare security update for @nuxt/schema (2 CVEs)","description":"TuxCare rebuilt @nuxt/schema to address 2 CVEs. Fixed in 3.12.4-tuxcare.7.","status":"published","published":"2026-10-16T14:39:50Z","modified":"2026-10-16T16:31:05.412360555Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161591","title":"TuxCare security update for @nuxt/schema (1 CVE)","description":"TuxCare rebuilt @nuxt/schema to address 1 CVE. Fixed in 3.12.3-tuxcare.4.","status":"published","published":"2026-10-16T14:39:51Z","modified":"2026-10-16T16:31:04.73161871Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161813","title":"TuxCare security update for @nuxt/vite-builder (1 CVE)","description":"TuxCare rebuilt @nuxt/vite-builder to address 1 CVE. Fixed in 3.12.3-tuxcare.4.","status":"published","published":"2026-10-16T14:43:33Z","modified":"2026-10-16T16:30:32.824363783Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161926","title":"TuxCare security update for @nuxt/webpack-builder (1 CVE)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 1 CVE. Fixed in 3.12.3-tuxcare.4.","status":"published","published":"2026-10-16T14:45:26Z","modified":"2026-10-16T16:31:41.016193062Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1793099909","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.5.5-tuxcare.2.","status":"published","published":"2026-10-27T11:18:29Z","modified":"2026-10-27T13:30:17.547057275Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793099949","title":"TuxCare security update for postcss (2 CVEs)","description":"TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.2.9-tuxcare.3.","status":"published","published":"2026-10-27T11:19:09Z","modified":"2026-10-27T13:30:09.457081882Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793706695","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.33-tuxcare.3.","status":"published","published":"2026-11-03T12:51:36Z","modified":"2026-11-03T19:30:09.642937787Z","updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"CLSA-2026-1793707849","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.17-tuxcare.3.","status":"published","published":"2026-11-03T13:10:49Z","modified":"2026-11-03T19:30:09.737807588Z","updated_at":"2026-11-03T20:03:57.215693Z"}]}}