beasty/beastypage

Fork 0

chore(deps): update dependency postcss to v8.5.23 [security] #38

Open

renovate-bot wants to merge 1 commit from renovate/npm-postcss-vulnerability into main

renovate-bot commented

2026-07-25 03:33:44 +00:00

Collaborator

This PR contains the following updates:

Package	Change	Age	Confidence
postcss (source)	`8.5.12` → `8.5.23`

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

GHSA-r28c-9q8g-f849

More information

Details

Vulnerability Details

File: lib/previous-map.js
Line: 87-98 (loadFile), 129-144 (loadMap)

Root Cause

PostCSS auto-detects a /*# sourceMappingURL=... */ comment inside the CSS text it is asked to parse and, unless the caller explicitly passes map: false, attempts to load that path from disk as a "previous source map." This happens on every postcss.parse() / postcss().process() call by default (opt-out, not opt-in).

loadMap() builds the candidate path via join(dirname(opts.from), annotation), where annotation is the raw, attacker-controlled string from the CSS comment. path.join() normalizes but does not sandbox .. segments, so a ../../../ prefix walks the resolved path outside the intended directory. If opts.from is not set at all, the annotation is used completely unmodified — an absolute path in the CSS comment is read verbatim.

8.5.12 already fixed a strictly worse variant of this (any file, any extension, could be read) by requiring the resolved path to end in .map (loadFile()). That fix did not address the traversal itself, only the target extension. Since the join(dirname(file), map) logic has existed unchanged since PostCSS 8.0.0 (Feb 2020), any file ending in .map remains readable through this path in the current release (8.5.16).

Once loaded, MapGenerator.isMap() treats the mere presence of a loaded "previous map" as an implicit request to generate result.map, even when the caller never set the map option. If the loaded map has a sourcesContent field (common for maps emitted by bundlers/transpilers), that content is merged into result.map and returned to the caller — disclosing the traversed-to file's content to whoever supplied the CSS.

Attack Scenario

A service accepts user-submitted CSS and runs it through PostCSS to lint/format/transform it, e.g. postcss().process(userCss, { from: '/app/uploads/user123/input.css', to: '/app/uploads/user123/output.css' }) — idiomatic usage; map option untouched.
Attacker submits CSS containing /*# sourceMappingURL=../../../../some/other/app/dist/bundle.js.map */ (or an absolute path if from is unset).
PostCSS reads that .map file and folds its sourcesContent into result.map.
The service does what most build pipelines do with a truthy result.map — writes it next to the CSS output or returns it via API (source maps are meant to be consumed by browser devtools, so this is commonly public/served).
Attacker retrieves the emitted map and reads out the traversed file's content.

Impact

Disclosure of the contents of arbitrary .map files reachable via path traversal (or absolute path when from is unset) from the process's filesystem. Affects any application processing CSS it does not fully trust without explicitly passing map: false. No authentication or user interaction beyond submitting CSS text is required.

Vulnerable Code

loadFile(path, cssFile, trusted) {
  if (!trusted && !this.unsafeMap) {
    if (!/\.map$/i.test(path)) {
      return undefined
    }
  }
  this.root = dirname(path)
  if (existsSync(path)) {
    this.mapFile = path
    return readFileSync(path, 'utf-8').toString().trim()
  }
}

loadMap(file, prev) {
  ...
  } else if (this.annotation) {
    let map = this.annotation
    if (file) map = join(dirname(file), map)
    let unknown = this.loadFile(map, file, false)
    ...
  }
}

Recommended Fix

Constrain the resolved path to remain inside the CSS file's own directory instead of relying solely on a filename-extension check:

loadFile(path, cssFile, trusted) {
  if (!trusted && !this.unsafeMap) {
    if (!/\.map$/i.test(path)) {
      return undefined
    }
    if (!cssFile) return undefined
    let root = resolve(dirname(cssFile))
    let resolvedPath = resolve(root, path)
    if (resolvedPath !== root && !resolvedPath.startsWith(root + sep)) {
      return undefined
    }
  }
  this.root = dirname(path)
  if (existsSync(path)) {
    this.mapFile = path
    return readFileSync(path, 'utf-8').toString().trim()
  }
}

I've implemented, tested (full existing test suite — 660/660 passing, plus new PoC-based regression checks for both the traversal and legitimate same-directory cases), and can share this fix on request or via a private fork if invited.

Verification

Dynamically confirmed on v8.5.16 (current npm release / repo HEAD) via a standalone Node.js harness against lib/postcss.js: a "secret" .map file placed two directories outside a simulated project directory was read via a crafted sourceMappingURL comment in otherwise-innocuous CSS, with its sourcesContent appearing verbatim in result.map.toString() — with no map option set by the caller. A second harness confirmed the simpler no-from case reads an absolute path directly. A third harness confirmed map: false is the only current workaround. The attached fix branch closes both vectors while keeping all 660 existing unit tests green.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

CVE-2026-69153 / GHSA-fxqj-rqcc-2cmp

More information

Details

Summary

The fix for GHSA-6g55-p6wh-862q added a guard in lib/previous-map.js PreviousMap.loadFile() that restricts an attacker-controlled sourceMappingURL (from a CSS comment) to a .map extension and, for untrusted maps, rejects .. traversal and absolute paths. The traversal/absolute rejection is nested inside if (cssFile) { ... }. When PostCSS is invoked without the from option, cssFile is falsy and that branch is skipped, leaving only the .map extension check.

PreviousMap is constructed by lib/input.js whenever pathAvailable && sourceMapAvailable (under Node with source-map available), independent of opts.from/opts.map (the constructor returns early only for opts.map === false). So postcss([]).process(css) on attacker CSS reaches loadFile with cssFile undefined, and an attacker /*# sourceMappingURL=/abs/path/x.map */ (or ../-traversing path) is read via readFileSync. When the file is valid JSON, its sources (filesystem paths) and sourcesContent (source contents) are disclosed in the generated source map.

Affected code (v8.5.22 — the release carrying the GHSA-6g55 fix)

// lib/previous-map.js
loadFile(path, cssFile, trusted) {
  if (!trusted && !this.unsafeMap) {
    if (!/\.map$/i.test(path)) {
      return undefined
    }
    if (cssFile) {                       // guard runs ONLY when `from` is set
      let relativePath = relative(dirname(cssFile), path)
      if (relativePath === '..' ||
          relativePath.startsWith('..' + sep) ||
          isAbsolute(relativePath)) {
        return undefined
      }
    }
  }
  this.root = dirname(path)
  if (existsSync(path)) {
    this.mapFile = path
    return readFileSync(path, 'utf-8').toString().trim()   // sink
  }
}

// loadMap(): untrusted annotation path, trusted=false; file === opts.from
} else if (this.annotation) {
  let map = this.annotation
  if (file) map = join(dirname(file), map)   // no `from` -> map stays the raw URL
  let unknown = this.loadFile(map, file, false)  // file undefined -> cssFile falsy

Proof of concept (verified on postcss 8.5.22)

const postcss = require('postcss')
const fs = require('fs')

// a 'secret' sourcemap OUTSIDE any expected tree (stand-in for another project's .map)
const secret = '/tmp/pcpoc/secret_out_of_tree.map'
fs.writeFileSync(secret, JSON.stringify({
  version: 3, sources: ['/etc/REAL_PATH_LEAK'], mappings: '', names: [],
  sourcesContent: ['TOP_SECRET_abcdef']
}))

const css = 'a{color:red}\n/*# sourceMappingURL=' + secret + ' */'
const leaks = m => m && JSON.stringify(m.toJSON ? m.toJSON() : m).includes('TOP_SECRET_abcdef')

;(async () => {
  // A) NO `from`  -> guard skipped -> arbitrary absolute .map read + disclosed
  const a = await postcss([]).process(css, { map: true })
  console.log('no from   -> leaked:', !!leaks(a.map))   // true

  // B) WITH `from` -> guard active -> blocked
  const b = await postcss([]).process(css, { from: '/tmp/pcpoc/in.css', map: true })
  console.log('with from -> leaked:', !!leaks(b.map))    // false
})()

Observed output on postcss 8.5.22:

no from   -> leaked: true      # sourcesContent 'TOP_SECRET_abcdef' AND sources '/etc/REAL_PATH_LEAK' appear in result.map
with from -> leaked: false     # guard rejects the absolute path

../ traversal (no from) also succeeds; non-.map targets (.txt, ?x=.map, #.map) are blocked by the .map check. The tested build contains the GHSA-6g55 fix (this.json = JSON.parse(...) in loadMap, consumer() uses this.json || this.text), so this is a residual of that fix.

Impact

Arbitrary .map-file read (absolute path or ../ traversal) and disclosure of the target map's sources (local filesystem paths) and sourcesContent (source) into the generated source map, for any consumer that runs PostCSS on attacker-influenced CSS without a from option and exposes result.map (online CSS playgrounds, minify/lint services, string-input build steps). Bounded to files ending in .map that parse as JSON.

Suggested fix

Apply the traversal/absolute-path rejection to the untrusted map path regardless of whether cssFile is present (resolve against process.cwd() when there is no cssFile, and reject absolute paths and .. escape in all untrusted cases), or refuse to load an untrusted external map when no base file is known.

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

postcss/postcss (postcss)

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [postcss](https://postcss.org/) ([source](https://github.com/postcss/postcss)) | [`8.5.12` → `8.5.23`](https://renovatebot.com/diffs/npm/postcss/8.5.12/8.5.23) | ![age](https://developer.mend.io/api/mc/badges/age/npm/postcss/8.5.23?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/postcss/8.5.12/8.5.23?slim=true) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/20) for more information. --- ### PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure [GHSA-r28c-9q8g-f849](https://github.com/advisories/GHSA-r28c-9q8g-f849) <details> <summary>More information</summary> #### Details ##### Vulnerability Details **File**: `lib/previous-map.js` **Line**: 87-98 (`loadFile`), 129-144 (`loadMap`) ##### Root Cause PostCSS auto-detects a `/*# sourceMappingURL=... */` comment inside the CSS text it is asked to parse and, unless the caller explicitly passes `map: false`, attempts to load that path from disk as a "previous source map." This happens on every `postcss.parse()` / `postcss().process()` call by default (opt-out, not opt-in). `loadMap()` builds the candidate path via `join(dirname(opts.from), annotation)`, where `annotation` is the raw, attacker-controlled string from the CSS comment. `path.join()` normalizes but does not sandbox `..` segments, so a `../../../` prefix walks the resolved path outside the intended directory. If `opts.from` is not set at all, the annotation is used completely unmodified — an absolute path in the CSS comment is read verbatim. 8.5.12 already fixed a strictly worse variant of this (any file, any extension, could be read) by requiring the resolved path to end in `.map` (`loadFile()`). That fix did not address the traversal itself, only the target extension. Since the `join(dirname(file), map)` logic has existed unchanged since PostCSS 8.0.0 (Feb 2020), any file ending in `.map` remains readable through this path in the current release (8.5.16). Once loaded, `MapGenerator.isMap()` treats the mere presence of a loaded "previous map" as an implicit request to generate `result.map`, even when the caller never set the `map` option. If the loaded map has a `sourcesContent` field (common for maps emitted by bundlers/transpilers), that content is merged into `result.map` and returned to the caller — disclosing the traversed-to file's content to whoever supplied the CSS. ##### Attack Scenario 1. A service accepts user-submitted CSS and runs it through PostCSS to lint/format/transform it, e.g. `postcss().process(userCss, { from: '/app/uploads/user123/input.css', to: '/app/uploads/user123/output.css' })` — idiomatic usage; `map` option untouched. 2. Attacker submits CSS containing `/*# sourceMappingURL=../../../../some/other/app/dist/bundle.js.map */` (or an absolute path if `from` is unset). 3. PostCSS reads that `.map` file and folds its `sourcesContent` into `result.map`. 4. The service does what most build pipelines do with a truthy `result.map` — writes it next to the CSS output or returns it via API (source maps are meant to be consumed by browser devtools, so this is commonly public/served). 5. Attacker retrieves the emitted map and reads out the traversed file's content. ##### Impact Disclosure of the contents of arbitrary `.map` files reachable via path traversal (or absolute path when `from` is unset) from the process's filesystem. Affects any application processing CSS it does not fully trust without explicitly passing `map: false`. No authentication or user interaction beyond submitting CSS text is required. ##### Vulnerable Code ```js loadFile(path, cssFile, trusted) { if (!trusted && !this.unsafeMap) { if (!/\.map$/i.test(path)) { return undefined } } this.root = dirname(path) if (existsSync(path)) { this.mapFile = path return readFileSync(path, 'utf-8').toString().trim() } } loadMap(file, prev) { ... } else if (this.annotation) { let map = this.annotation if (file) map = join(dirname(file), map) let unknown = this.loadFile(map, file, false) ... } } ``` ##### Recommended Fix Constrain the resolved path to remain inside the CSS file's own directory instead of relying solely on a filename-extension check: ```js loadFile(path, cssFile, trusted) { if (!trusted && !this.unsafeMap) { if (!/\.map$/i.test(path)) { return undefined } if (!cssFile) return undefined let root = resolve(dirname(cssFile)) let resolvedPath = resolve(root, path) if (resolvedPath !== root && !resolvedPath.startsWith(root + sep)) { return undefined } } this.root = dirname(path) if (existsSync(path)) { this.mapFile = path return readFileSync(path, 'utf-8').toString().trim() } } ``` I've implemented, tested (full existing test suite — 660/660 passing, plus new PoC-based regression checks for both the traversal and legitimate same-directory cases), and can share this fix on request or via a private fork if invited. ##### Verification Dynamically confirmed on v8.5.16 (current npm release / repo HEAD) via a standalone Node.js harness against `lib/postcss.js`: a "secret" `.map` file placed two directories outside a simulated project directory was read via a crafted `sourceMappingURL` comment in otherwise-innocuous CSS, with its `sourcesContent` appearing verbatim in `result.map.toString()` — with no `map` option set by the caller. A second harness confirmed the simpler no-`from` case reads an absolute path directly. A third harness confirmed `map: false` is the only current workaround. The attached fix branch closes both vectors while keeping all 660 existing unit tests green. #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` #### References - [https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849](https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849) - [https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c](https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c) - [https://github.com/postcss/postcss](https://github.com/postcss/postcss) - [https://github.com/postcss/postcss/releases/tag/8.5.18](https://github.com/postcss/postcss/releases/tag/8.5.18) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-r28c-9q8g-f849) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset [CVE-2026-69153](https://nvd.nist.gov/vuln/detail/CVE-2026-69153) / [GHSA-fxqj-rqcc-2cmp](https://github.com/advisories/GHSA-fxqj-rqcc-2cmp) <details> <summary>More information</summary> #### Details ##### Summary The fix for GHSA-6g55-p6wh-862q added a guard in `lib/previous-map.js` `PreviousMap.loadFile()` that restricts an attacker-controlled `sourceMappingURL` (from a CSS comment) to a `.map` extension and, for untrusted maps, rejects `..` traversal and absolute paths. The traversal/absolute rejection is nested inside `if (cssFile) { ... }`. When PostCSS is invoked without the `from` option, `cssFile` is falsy and that branch is skipped, leaving only the `.map` extension check. `PreviousMap` is constructed by `lib/input.js` whenever `pathAvailable && sourceMapAvailable` (under Node with source-map available), independent of `opts.from`/`opts.map` (the constructor returns early only for `opts.map === false`). So `postcss([]).process(css)` on attacker CSS reaches `loadFile` with `cssFile` undefined, and an attacker `/*# sourceMappingURL=/abs/path/x.map */` (or `../`-traversing path) is read via `readFileSync`. When the file is valid JSON, its `sources` (filesystem paths) and `sourcesContent` (source contents) are disclosed in the generated source map. ##### Affected code (v8.5.22 — the release carrying the GHSA-6g55 fix) ```js // lib/previous-map.js loadFile(path, cssFile, trusted) { if (!trusted && !this.unsafeMap) { if (!/\.map$/i.test(path)) { return undefined } if (cssFile) { // guard runs ONLY when `from` is set let relativePath = relative(dirname(cssFile), path) if (relativePath === '..' || relativePath.startsWith('..' + sep) || isAbsolute(relativePath)) { return undefined } } } this.root = dirname(path) if (existsSync(path)) { this.mapFile = path return readFileSync(path, 'utf-8').toString().trim() // sink } } // loadMap(): untrusted annotation path, trusted=false; file === opts.from } else if (this.annotation) { let map = this.annotation if (file) map = join(dirname(file), map) // no `from` -> map stays the raw URL let unknown = this.loadFile(map, file, false) // file undefined -> cssFile falsy ``` ##### Proof of concept (verified on postcss 8.5.22) ```js const postcss = require('postcss') const fs = require('fs') // a 'secret' sourcemap OUTSIDE any expected tree (stand-in for another project's .map) const secret = '/tmp/pcpoc/secret_out_of_tree.map' fs.writeFileSync(secret, JSON.stringify({ version: 3, sources: ['/etc/REAL_PATH_LEAK'], mappings: '', names: [], sourcesContent: ['TOP_SECRET_abcdef'] })) const css = 'a{color:red}\n/*# sourceMappingURL=' + secret + ' */' const leaks = m => m && JSON.stringify(m.toJSON ? m.toJSON() : m).includes('TOP_SECRET_abcdef') ;(async () => { // A) NO `from` -> guard skipped -> arbitrary absolute .map read + disclosed const a = await postcss([]).process(css, { map: true }) console.log('no from -> leaked:', !!leaks(a.map)) // true // B) WITH `from` -> guard active -> blocked const b = await postcss([]).process(css, { from: '/tmp/pcpoc/in.css', map: true }) console.log('with from -> leaked:', !!leaks(b.map)) // false })() ``` Observed output on postcss 8.5.22: ``` no from -> leaked: true # sourcesContent 'TOP_SECRET_abcdef' AND sources '/etc/REAL_PATH_LEAK' appear in result.map with from -> leaked: false # guard rejects the absolute path ``` `../` traversal (no `from`) also succeeds; non-`.map` targets (`.txt`, `?x=.map`, `#.map`) are blocked by the `.map` check. The tested build contains the GHSA-6g55 fix (`this.json = JSON.parse(...)` in `loadMap`, `consumer()` uses `this.json || this.text`), so this is a residual of that fix. ##### Impact Arbitrary `.map`-file read (absolute path or `../` traversal) and disclosure of the target map's `sources` (local filesystem paths) and `sourcesContent` (source) into the generated source map, for any consumer that runs PostCSS on attacker-influenced CSS without a `from` option and exposes `result.map` (online CSS playgrounds, minify/lint services, string-input build steps). Bounded to files ending in `.map` that parse as JSON. ##### Suggested fix Apply the traversal/absolute-path rejection to the untrusted map path regardless of whether `cssFile` is present (resolve against `process.cwd()` when there is no `cssFile`, and reject absolute paths and `..` escape in all untrusted cases), or refuse to load an untrusted external map when no base file is known. #### Severity - CVSS Score: 6.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp](https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp) - [https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8](https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8) - [https://github.com/postcss/postcss](https://github.com/postcss/postcss) - [https://github.com/postcss/postcss/releases/tag/8.5.19](https://github.com/postcss/postcss/releases/tag/8.5.19) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-fxqj-rqcc-2cmp) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>postcss/postcss (postcss)</summary> ### [`v8.5.23`](https://github.com/postcss/postcss/compare/a3e48c492ddec0e4879d513b8b995fee887af352...eb9e1fe793740bb3280bdf5bf98147f857f011bd) [Compare Source](https://github.com/postcss/postcss/compare/a3e48c492ddec0e4879d513b8b995fee887af352...eb9e1fe793740bb3280bdf5bf98147f857f011bd) ### [`v8.5.22`](https://github.com/postcss/postcss/compare/28e0daf8f2fe5ba9e19ea3f8c27c8fe176f9419e...a3e48c492ddec0e4879d513b8b995fee887af352) [Compare Source](https://github.com/postcss/postcss/compare/28e0daf8f2fe5ba9e19ea3f8c27c8fe176f9419e...a3e48c492ddec0e4879d513b8b995fee887af352) ### [`v8.5.21`](https://github.com/postcss/postcss/compare/c4ac725d5920916d35be44002b49b7f66f8b1dc8...28e0daf8f2fe5ba9e19ea3f8c27c8fe176f9419e) [Compare Source](https://github.com/postcss/postcss/compare/c4ac725d5920916d35be44002b49b7f66f8b1dc8...28e0daf8f2fe5ba9e19ea3f8c27c8fe176f9419e) ### [`v8.5.20`](https://github.com/postcss/postcss/compare/9543b22769bef5bcd47600fbca752204c106cda8...c4ac725d5920916d35be44002b49b7f66f8b1dc8) [Compare Source](https://github.com/postcss/postcss/compare/9543b22769bef5bcd47600fbca752204c106cda8...c4ac725d5920916d35be44002b49b7f66f8b1dc8) ### [`v8.5.19`](https://github.com/postcss/postcss/compare/4c0d194c136fd374495d0993c890d794cab65b81...9543b22769bef5bcd47600fbca752204c106cda8) [Compare Source](https://github.com/postcss/postcss/compare/4c0d194c136fd374495d0993c890d794cab65b81...9543b22769bef5bcd47600fbca752204c106cda8) ### [`v8.5.18`](https://github.com/postcss/postcss/compare/74e25ae9f4efaa56a41a449064a655d7da78072c...4c0d194c136fd374495d0993c890d794cab65b81) [Compare Source](https://github.com/postcss/postcss/compare/74e25ae9f4efaa56a41a449064a655d7da78072c...4c0d194c136fd374495d0993c890d794cab65b81) ### [`v8.5.17`](https://github.com/postcss/postcss/compare/92ccc93ff15bd193491d67fad9763e62d489dfad...74e25ae9f4efaa56a41a449064a655d7da78072c) [Compare Source](https://github.com/postcss/postcss/compare/92ccc93ff15bd193491d67fad9763e62d489dfad...74e25ae9f4efaa56a41a449064a655d7da78072c) ### [`v8.5.16`](https://github.com/postcss/postcss/compare/eae46db765d752cf8f40c4fa2b0b85030079c43d...92ccc93ff15bd193491d67fad9763e62d489dfad) [Compare Source](https://github.com/postcss/postcss/compare/eae46db765d752cf8f40c4fa2b0b85030079c43d...92ccc93ff15bd193491d67fad9763e62d489dfad) ### [`v8.5.15`](https://github.com/postcss/postcss/compare/3ec13948ae0006e1bde2dfb545346341ac8b2dcf...eae46db765d752cf8f40c4fa2b0b85030079c43d) [Compare Source](https://github.com/postcss/postcss/compare/3ec13948ae0006e1bde2dfb545346341ac8b2dcf...eae46db765d752cf8f40c4fa2b0b85030079c43d) ### [`v8.5.14`](https://github.com/postcss/postcss/compare/af58cf1b7af02e9b9fcb138a4a2d7ef3450158b1...3ec13948ae0006e1bde2dfb545346341ac8b2dcf) [Compare Source](https://github.com/postcss/postcss/compare/af58cf1b7af02e9b9fcb138a4a2d7ef3450158b1...3ec13948ae0006e1bde2dfb545346341ac8b2dcf) ### [`v8.5.13`](https://github.com/postcss/postcss/compare/9bc81c48f054a630c9a2e3868263b7ad4fc15013...af58cf1b7af02e9b9fcb138a4a2d7ef3450158b1) [Compare Source](https://github.com/postcss/postcss/compare/9bc81c48f054a630c9a2e3868263b7ad4fc15013...af58cf1b7af02e9b9fcb138a4a2d7ef3450158b1) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-07-25 03:33:44 +00:00

chore(deps): update dependency postcss to v8.5.18 [security] 7bd95dcfd6

renovate-bot force-pushed renovate/npm-postcss-vulnerability from 7bd95dcfd6 to 63d8af8847

2026-08-04 03:32:29 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update dependency postcss to v8.5.18 [security]~~ to chore(deps): update dependency postcss to v8.5.23 [security]

2026-08-04 03:32:33 +00:00

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/npm-postcss-vulnerability:renovate/npm-postcss-vulnerability

git switch renovate/npm-postcss-vulnerability

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff renovate/npm-postcss-vulnerability

git switch renovate/npm-postcss-vulnerability

git rebase main

git switch main

git merge --ff-only renovate/npm-postcss-vulnerability

git switch renovate/npm-postcss-vulnerability

git rebase main

git switch main

git merge --no-ff renovate/npm-postcss-vulnerability

git switch main

git merge --squash renovate/npm-postcss-vulnerability

git switch main

git merge --ff-only renovate/npm-postcss-vulnerability

git switch main

git merge renovate/npm-postcss-vulnerability

git push origin main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

beasty/beastypage!38

No description provided.

Rows
Columns

chore(deps): update dependency postcss to v8.5.23 [security] #38

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

Details

Vulnerability Details

Root Cause

Attack Scenario

Impact

Vulnerable Code

Recommended Fix

Verification

Severity

References

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset

Details

Summary

Affected code (v8.5.22 — the release carrying the GHSA-6g55 fix)

Proof of concept (verified on postcss 8.5.22)

Impact

Suggested fix

Severity

References

Release Notes

Configuration

Checkout

Merge

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset