CVE-2026-41305: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

CVE-2026-41305 · Severity: medium · CVSS 6.1 · Published 2026-04-24

PostCSS is a popular CSS parsing and processing library used in web development pipelines. When user-supplied CSS is parsed and re-stringified for embedding in HTML style tags, the library fails to escape closing style tag sequences, allowing an attacker to break out of the style context and inject arbitrary JavaScript. This vulnerability requires user interaction (the CSS must be processed and embedded in a web page) and affects applications that dynamically generate styles from untrusted input.

Technologies: postcss (npm). Vendors: npm.

Quick answers

Is CVE-2026-41305 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41305 being exploited in the wild.
How severe is CVE-2026-41305?
Medium severity, with a CVSS score of 6.1, published 24 April 2026.
Which products and versions are affected?
postcss (npm) < 8.5.10, SEMVER:introduced=0,fixed=8.5.10.
Is there a fix for CVE-2026-41305?
Yes. postcss (npm): upgrade to 8.5.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41305 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41305?
Check whether you run postcss (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • postcss (npm): upgrade to 8.5.10 or later
    npm install postcss@8.5.10

Technical details

This is a cross-site scripting (XSS) vulnerability in PostCSS's CSS stringification process. The root cause is that when PostCSS converts its Abstract Syntax Tree (AST) back to CSS string form, it does not escape &lt;/style&gt; sequences found in CSS values. An attacker can inject CSS like `content: "&lt;/style&gt;&lt;script&gt;alert(1)&lt;/script&gt;&lt;style&gt;"` which, when re-stringified and embedded in an HTML style tag, breaks out of the style context and executes arbitrary JavaScript in the browser. The attack vector is network-based and requires no authentication, but does require user interaction (the malicious CSS must be processed and the resulting HTML served to a victim). The vulnerability affects PostCSS versions before 8.5.10; a patch is available that escapes &lt;/style sequences during stringification.

Affected products

  • PostCSS PostCSS <8.5.10

Identifiers

  • CVE-2026-41305
  • GHSA-qx2v-qp2m-jg93

Timeline

  • 2026-04-20: disclosed
  • 2026-04-24: patched: version 8.5.10 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.