{"id":"CVE-2026-73646","aliases":["CLSA-2026-1787592261","CLSA-2026-1790019520","CLSA-2026-1790023229","CLSA-2026-1790023231","CLSA-2026-1790089248","CLSA-2026-1790089252","CLSA-2026-1790089264","CLSA-2026-1790089280","CLSA-2026-1790089282","CLSA-2026-1790099843","CLSA-2026-1790102697","CLSA-2026-1790541900","CLSA-2026-1790604941","CLSA-2026-1791377049","CLSA-2026-1791377114","CLSA-2026-1791629015","CLSA-2026-1791629172","CLSA-2026-1791633202","CLSA-2026-1791832298","CLSA-2026-1792765677","CLSA-2026-1792765790","CLSA-2026-1792791822","CLSA-2026-1793097120","CLSA-2026-1793097204","CLSA-2026-1793125669","DEBIAN-CVE-2026-73646","EUVD-2026-60239","GHSA-r28c-9q8g-f849","RHSA-2026:50287","RHSA-2026:54520","ROOT-APP-NPM-CVE-2026-73646","UBUNTU-CVE-2026-73646","openSUSE-SU-2026:12070-1"],"status":"published","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0053,"percentile":0.45077,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-08-05T10:37:35Z","modified":"2026-10-28T02:30:42Z","fixes":[{"ecosystem":"TuxCare:npm","package":"postcss","fixed_in":["8.3.6-tuxcare.5","7.0.32-tuxcare.3","7.0.17-tuxcare.3","5.2.18-tuxcare.3","8.4.14-tuxcare.5","8.4.5-tuxcare.4","8.4.31-tuxcare.4","8.4.41-tuxcare.5","8.2.15-tuxcare.4","8.5.6-tuxcare.5","8.2.13-tuxcare.3","8.5.17-tuxcare.1","7.0.14-tuxcare.4","7.0.21-tuxcare.4","8.4.17-tuxcare.2","8.4.33-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-postcss","fixed_in":["8.5.19+~cs10.2.23-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"postcss","fixed_in":["8.4.49-aikido.4","6.0.1-aikido.2","8.4.38-aikido.2","8.5.3-aikido.3","8.4.21-aikido.2","8.5.15-aikido.2","7.0.39-aikido.7","8.5.8-aikido.5","5.2.18-aikido.5","7.0.32-aikido.1","8.4.32-aikido.1","7.0.36-aikido.1","8.5.6-aikido.5","6.0.23-aikido.3","8.4.31-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/postcss","fixed_in":["8.4.49-root.io.4","6.0.1-root.io.2","8.4.38-root.io.2","8.5.3-root.io.3","8.4.21-root.io.2","8.5.15-root.io.2","7.0.39-root.io.7","8.5.8-root.io.5","5.2.18-root.io.5","7.0.32-root.io.1","8.4.32-root.io.1","7.0.36-root.io.1","8.5.6-root.io.5","6.0.23-root.io.3","8.4.31-root.io.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.3.6-tuxcare.0"},{"fixed":"8.3.6-tuxcare.5"}]}],"versions":["8.3.6","8.3.6-tuxcare.1","8.3.6-tuxcare.2","8.3.6-tuxcare.3","8.3.6-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.32-tuxcare.0"},{"fixed":"7.0.32-tuxcare.3"}]}],"versions":["7.0.32","7.0.32-tuxcare.1","7.0.32-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.17-tuxcare.0"},{"fixed":"7.0.17-tuxcare.3"}]}],"versions":["7.0.17","7.0.17-tuxcare.1","7.0.17-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.18-tuxcare.0"},{"fixed":"5.2.18-tuxcare.3"}]}],"versions":["5.2.18","5.2.18-tuxcare.1","5.2.18-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.14-tuxcare.0"},{"fixed":"8.4.14-tuxcare.5"}]}],"versions":["8.4.14","8.4.14-tuxcare.1","8.4.14-tuxcare.2","8.4.14-tuxcare.3","8.4.14-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.5-tuxcare.0"},{"fixed":"8.4.5-tuxcare.4"}]}],"versions":["8.4.5","8.4.5-tuxcare.1","8.4.5-tuxcare.2","8.4.5-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.31-tuxcare.0"},{"fixed":"8.4.31-tuxcare.4"}]}],"versions":["8.4.31","8.4.31-tuxcare.1","8.4.31-tuxcare.2","8.4.31-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.41-tuxcare.0"},{"fixed":"8.4.41-tuxcare.5"}]}],"versions":["8.4.41","8.4.41-tuxcare.1","8.4.41-tuxcare.2","8.4.41-tuxcare.3","8.4.41-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.15-tuxcare.0"},{"fixed":"8.2.15-tuxcare.4"}]}],"versions":["8.2.15","8.2.15-tuxcare.1","8.2.15-tuxcare.2","8.2.15-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.6-tuxcare.0"},{"fixed":"8.5.6-tuxcare.5"}]}],"versions":["8.5.6","8.5.6-tuxcare.1","8.5.6-tuxcare.2","8.5.6-tuxcare.3","8.5.6-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.13-tuxcare.0"},{"fixed":"8.2.13-tuxcare.3"}]}],"versions":["8.2.13","8.2.13-tuxcare.1","8.2.13-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.17-tuxcare.0"},{"fixed":"8.5.17-tuxcare.1"}]}],"versions":["8.5.17"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.1-tuxcare.0"},{"fixed":"6.0.1-tuxcare.1"}]}],"versions":["6.0.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.14-tuxcare.0"},{"fixed":"7.0.14-tuxcare.4"}]}],"versions":["7.0.14","7.0.14-tuxcare.1","7.0.14-tuxcare.2","7.0.14-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.21-tuxcare.0"},{"fixed":"7.0.21-tuxcare.4"}]}],"versions":["7.0.21","7.0.21-tuxcare.1","7.0.21-tuxcare.2","7.0.21-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.3-tuxcare.0"},{"fixed":"8.5.3-tuxcare.2"}]}],"versions":["8.5.3","8.5.3-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.2-tuxcare.0"},{"fixed":"8.5.2-tuxcare.2"}]}],"versions":["8.5.2","8.5.2-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.49-tuxcare.0"},{"fixed":"8.4.49-tuxcare.1"}]}],"versions":["8.4.49"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.12-tuxcare.0"},{"fixed":"8.5.12-tuxcare.2"}]}],"versions":["8.5.12","8.5.12-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.14-tuxcare.0"},{"fixed":"8.5.14-tuxcare.1"}]}],"versions":["8.5.14"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.35-tuxcare.0"},{"fixed":"8.4.35-tuxcare.1"}]}],"versions":["8.4.35"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.2.9-tuxcare.0"},{"fixed":"8.2.9-tuxcare.2"}]}],"versions":["8.2.9","8.2.9-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.17-tuxcare.0"},{"fixed":"8.4.17-tuxcare.2"}]}],"versions":["8.4.17","8.4.17-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.4.33-tuxcare.0"},{"fixed":"8.4.33-tuxcare.2"}]}],"versions":["8.4.33","8.4.33-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.5-tuxcare.0"},{"fixed":"8.5.5-tuxcare.3"}]}],"versions":["8.5.5","8.5.5-tuxcare.1","8.5.5-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.20+~cs8.0.23-1","8.4.20+~cs8.0.23-1+deb12u1","8.4.31+~cs8.0.26-1","8.4.39+~cs9.2.29-1","8.4.49+~cs9.2.32-1","8.5.12+~cs9.3.32-1","8.5.14+~cs9.3.34-1","8.5.15+~cs9.3.34-1","8.5.15+~cs9.3.38-1","8.5.15+~cs9.3.39-1","8.5.19+~cs10.2.23-1","8.5.21+~cs10.2.23-1","8.5.23+~cs10.2.23-1","8.5.25+~cs10.2.23-1","8.5.26+~cs10.2.24-1","8.5.28+~cs10.2.24-1","8.5.6+~cs9.3.28-1","8.5.8+~cs9.3.30-1","8.5.9+~cs9.3.30-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.49+~cs9.2.32-1","8.5.12+~cs9.3.32-1","8.5.14+~cs9.3.34-1","8.5.15+~cs9.3.34-1","8.5.15+~cs9.3.38-1","8.5.15+~cs9.3.39-1","8.5.19+~cs10.2.23-1","8.5.21+~cs10.2.23-1","8.5.23+~cs10.2.23-1","8.5.25+~cs10.2.23-1","8.5.26+~cs10.2.24-1","8.5.28+~cs10.2.24-1","8.5.6+~cs9.3.28-1","8.5.8+~cs9.3.30-1","8.5.9+~cs9.3.30-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.19+~cs10.2.23-1"}]}],"versions":["8.4.49+~cs9.2.32-1","8.5.12+~cs9.3.32-1","8.5.14+~cs9.3.34-1","8.5.15+~cs9.3.34-1","8.5.15+~cs9.3.38-1","8.5.15+~cs9.3.39-1","8.5.6+~cs9.3.28-1","8.5.8+~cs9.3.30-1","8.5.9+~cs9.3.30-1"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"prometheus3.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.13.2-0.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"prometheus3.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.5-0.8.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:npm","package":"postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.49-aikido.4"},{"fixed":"6.0.1-aikido.2"},{"fixed":"8.4.38-aikido.2"},{"fixed":"8.5.3-aikido.3"},{"fixed":"8.4.21-aikido.2"},{"fixed":"8.5.15-aikido.2"},{"fixed":"7.0.39-aikido.7"},{"fixed":"8.5.8-aikido.5"},{"fixed":"5.2.18-aikido.5"},{"fixed":"7.0.32-aikido.1"},{"fixed":"8.4.32-aikido.1"},{"fixed":"7.0.36-aikido.1"},{"fixed":"8.5.6-aikido.5"},{"fixed":"6.0.23-aikido.3"},{"fixed":"8.4.31-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.49-root.io.4"},{"fixed":"6.0.1-root.io.2"},{"fixed":"8.4.38-root.io.2"},{"fixed":"8.5.3-root.io.3"},{"fixed":"8.4.21-root.io.2"},{"fixed":"8.5.15-root.io.2"},{"fixed":"7.0.39-root.io.7"},{"fixed":"8.5.8-root.io.5"},{"fixed":"5.2.18-root.io.5"},{"fixed":"7.0.32-root.io.1"},{"fixed":"8.4.32-root.io.1"},{"fixed":"7.0.36-root.io.1"},{"fixed":"8.5.6-root.io.5"},{"fixed":"6.0.23-root.io.3"},{"fixed":"8.4.31-root.io.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.23-1","6.0.23-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.2.1+~cs5.3.23-8","8.4.5+~cs7.1.51-2","8.4.6+~cs7.3.21-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.20+~cs8.0.23-1","8.4.31+~cs8.0.26-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-postcss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.5.6+~cs9.3.28-1","8.5.8+~cs9.3.30-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.7.0.git145.b60ef1146-1.1"}]}],"bundled":40}],"products":[{"vendor":"postcss","product":"postcss"}],"references":[{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849","tags":["x_refsource_CONFIRM","exploit","advisory","article","report"]},{"url":"https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.18","tags":["x_refsource_MISC","web","article"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73646.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73646","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-73646","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50287","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69153","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73086","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-72815","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73646","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50287.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510719","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8","tags":["article"]},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.19","tags":["article"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515988","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72815","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72815","tags":["advisory"]},{"url":"https://github.com/go-chi/chi/security/advisories/GHSA-3fxj-6jh8-hvhx","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/go-chi-chi-ip-spoofing-via-x-forwarded-for-header","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73086","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/3.3.12","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.1.11","tags":["article"]},{"url":"https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517456","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73646","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54520","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54520.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-73646","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84370","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-73646","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.","status":"published","published":"2026-08-17T15:35:13.518Z","modified":"2026-08-17T16:36:37.422Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:43:33.766176Z"}],"euvd":[{"id":"EUVD-2026-60239","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.","status":"published","published":"2026-08-17T15:35:13Z","modified":"2026-08-17T16:36:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:48.853514Z"}],"nvd":[{"id":"CVE-2026-73646","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.","status":"published","published":"2026-08-17T16:17:47.257Z","modified":"2026-09-18T20:05:53.723Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:38.647684Z"}],"osv":[{"id":"CVE-2026-73646","title":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.","status":"published","published":"2026-08-17T15:35:13.518Z","modified":"2026-10-28T02:30:42.493429268Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:16.365946Z"},{"id":"DEBIAN-CVE-2026-73646","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.","status":"published","published":"2026-08-17T16:17:47.257Z","modified":"2026-10-01T03:03:49.202374474Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:02.499355Z"},{"id":"RHSA-2026:50287","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-05T10:37:35Z","modified":"2026-10-20T10:10:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:54520","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-14T10:16:48Z","modified":"2026-10-20T10:11:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"UBUNTU-CVE-2026-73646","description":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.","status":"published","published":"2026-08-17T16:17:00Z","modified":"2026-08-19T13:34:34.55300872Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:57:08.628462Z"},{"id":"CLSA-2026-1787592261","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.3.6-tuxcare.5.","status":"published","published":"2026-08-24T17:24:21Z","modified":"2026-10-15T09:48:03.1031919Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1790019520","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 7.0.32-tuxcare.3.","status":"published","published":"2026-09-21T19:38:40Z","modified":"2026-10-15T09:46:02.457491039Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790023229","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 7.0.17-tuxcare.3.","status":"published","published":"2026-09-21T20:40:29Z","modified":"2026-10-15T09:47:08.837960207Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790023231","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 5.2.18-tuxcare.3.","status":"published","published":"2026-09-21T20:40:31Z","modified":"2026-10-15T09:47:08.732226506Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790089248","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.14-tuxcare.5.","status":"published","published":"2026-09-22T15:00:48Z","modified":"2026-10-15T09:45:34.385513784Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790089252","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.5-tuxcare.4.","status":"published","published":"2026-09-22T15:00:52Z","modified":"2026-10-15T09:47:14.54798535Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790089264","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.31-tuxcare.4.","status":"published","published":"2026-09-22T15:01:04Z","modified":"2026-10-15T09:47:14.551511897Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790089280","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.41-tuxcare.5.","status":"published","published":"2026-09-22T15:01:20Z","modified":"2026-10-15T09:46:02.19990318Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790089282","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.2.15-tuxcare.4.","status":"published","published":"2026-09-22T15:01:22Z","modified":"2026-10-15T09:47:08.752862954Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790099843","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.5.6-tuxcare.5.","status":"published","published":"2026-09-22T17:57:23Z","modified":"2026-10-15T09:47:14.696012582Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790102697","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.2.13-tuxcare.3.","status":"published","published":"2026-09-22T18:44:57Z","modified":"2026-10-15T09:45:34.416996156Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790541900","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.5.17-tuxcare.1.","status":"published","published":"2026-09-27T20:45:00Z","modified":"2026-10-15T09:47:38.181729446Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790604941","title":"TuxCare security update for postcss (6 CVEs)","description":"TuxCare rebuilt postcss to address 6 CVEs. Fixed in 6.0.1-tuxcare.1.","status":"published","published":"2026-09-28T14:15:41Z","modified":"2026-10-15T09:48:04.060835227Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791377049","title":"TuxCare security update for postcss (2 CVEs)","description":"TuxCare rebuilt postcss to address 2 CVEs. Fixed in 7.0.14-tuxcare.4.","status":"published","published":"2026-10-07T12:44:09Z","modified":"2026-10-15T09:47:58.325426831Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791377114","title":"TuxCare security update for postcss (2 CVEs)","description":"TuxCare rebuilt postcss to address 2 CVEs. Fixed in 7.0.21-tuxcare.4.","status":"published","published":"2026-10-07T12:45:14Z","modified":"2026-10-15T09:47:58.356280453Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791629015","title":"TuxCare security update for postcss (2 CVEs)","description":"TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.5.3-tuxcare.2.","status":"published","published":"2026-10-10T10:43:35Z","modified":"2026-10-15T09:48:04.605782142Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791629172","title":"TuxCare security update for postcss (2 CVEs)","description":"TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.5.2-tuxcare.2.","status":"published","published":"2026-10-10T10:46:12Z","modified":"2026-10-15T09:47:59.819443511Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791633202","title":"TuxCare security update for postcss (4 CVEs)","description":"TuxCare rebuilt postcss to address 4 CVEs. Fixed in 8.4.49-tuxcare.1.","status":"published","published":"2026-10-10T11:53:22Z","modified":"2026-10-15T09:48:04.606976649Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791832298","title":"TuxCare security update for postcss (2 CVEs)","description":"TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.5.12-tuxcare.2.","status":"published","published":"2026-10-12T19:11:38Z","modified":"2026-10-15T09:47:53.548964202Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792765677","title":"TuxCare security update for postcss (2 CVEs)","description":"TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.5.14-tuxcare.1.","status":"published","published":"2026-10-23T14:27:57Z","modified":"2026-10-23T19:15:08.386046974Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792765790","title":"TuxCare security update for postcss (3 CVEs)","description":"TuxCare rebuilt postcss to address 3 CVEs. Fixed in 8.4.35-tuxcare.1.","status":"published","published":"2026-10-23T14:29:50Z","modified":"2026-10-23T19:15:07.504427572Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792791822","title":"TuxCare security update for postcss (3 CVEs)","description":"TuxCare rebuilt postcss to address 3 CVEs. Fixed in 8.2.9-tuxcare.2.","status":"published","published":"2026-10-23T21:43:42Z","modified":"2026-10-24T01:30:02.395384648Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1793097120","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.17-tuxcare.2.","status":"published","published":"2026-10-27T10:32:00Z","modified":"2026-10-27T13:30:07.671596408Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793097204","title":"TuxCare security update for postcss (1 CVE)","description":"TuxCare rebuilt postcss to address 1 CVE. Fixed in 8.4.33-tuxcare.2.","status":"published","published":"2026-10-27T10:33:23Z","modified":"2026-10-27T13:30:08.550871336Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793125669","title":"TuxCare security update for postcss (2 CVEs)","description":"TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.5.5-tuxcare.3.","status":"published","published":"2026-10-27T18:27:49Z","modified":"2026-10-27T19:30:07.248034408Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"openSUSE-SU-2026:12070-1","title":"velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.76.7.0.git145.b60ef1146-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-07T17:23:11.433086957Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"ROOT-APP-NPM-CVE-2026-73646","title":"CVE-2026-73646 in postcss - Patched by Root","description":"Root has patched CVE-2026-73646 in the postcss package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-25T06:36:42Z","modified":"2026-09-25T07:15:21.785235458Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}