# CVE-2026-41305: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

Source: https://junglewise.ai/threats/cve-2026-41305-postcss-has-xss-via-unescaped-style-in-its-css-stringify-output  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-41305 · Severity: medium · CVSS 6.1 · Published 2026-04-24

PostCSS is a popular CSS parsing and processing library used in web development pipelines. When user-supplied CSS is parsed and re-stringified for embedding in HTML style tags, the library fails to escape closing style tag sequences, allowing an attacker to break out of the style context and inject arbitrary JavaScript. This vulnerability requires user interaction (the CSS must be processed and embedded in a web page) and affects applications that dynamically generate styles from untrusted input.

Technologies: [postcss (npm)](https://junglewise.ai/threats/technologies/postcss). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-41305 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41305 being exploited in the wild.

**How severe is CVE-2026-41305?** Medium severity, with a CVSS score of 6.1, published 24 April 2026.

**Which products and versions are affected?** postcss (npm) < 8.5.10, SEMVER:introduced=0,fixed=8.5.10.

**Is there a fix for CVE-2026-41305?** Yes. postcss (npm): upgrade to 8.5.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41305 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41305?** Check whether you run postcss (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- postcss (npm): upgrade to 8.5.10 or later

  ```sh
  npm install postcss@8.5.10
  ```


## Technical details

This is a cross-site scripting (XSS) vulnerability in PostCSS's CSS stringification process. The root cause is that when PostCSS converts its Abstract Syntax Tree (AST) back to CSS string form, it does not escape &lt;/style&gt; sequences found in CSS values. An attacker can inject CSS like `content: "&lt;/style&gt;&lt;script&gt;alert(1)&lt;/script&gt;&lt;style&gt;"` which, when re-stringified and embedded in an HTML style tag, breaks out of the style context and executes arbitrary JavaScript in the browser. The attack vector is network-based and requires no authentication, but does require user interaction (the malicious CSS must be processed and the resulting HTML served to a victim). The vulnerability affects PostCSS versions before 8.5.10; a patch is available that escapes &lt;/style sequences during stringification.

## Affected products

- PostCSS PostCSS <8.5.10

## Identifiers

- CVE-2026-41305
- GHSA-qx2v-qp2m-jg93

## Timeline

- 2026-04-20: disclosed
- 2026-04-24: patched: version 8.5.10 released with fix

## References

- [https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93](https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93)

## Related threats

- [PostCSS path traversal in source map auto-loading](https://junglewise.ai/threats/cve-2026-73646-postcss-path-traversal-in-source-map-auto-loading)
- [PostCSS path traversal in sourceMappingURL parsing](https://junglewise.ai/threats/cve-2026-69153-postcss-path-traversal-in-sourcemappingurl-parsing)
- [PostCSS arbitrary file read via sourceMappingURL path traversal](https://junglewise.ai/threats/cve-2026-45623-postcss-arbitrary-file-read-via-sourcemappingurl-path-traversal)
- [PostCSS line return parsing error in CSS tokenization](https://junglewise.ai/threats/cve-2023-44270-postcss-line-return-parsing-error-in-css-tokenization)
- [PostCSS regular expression denial of service in previous-map](https://junglewise.ai/threats/cve-2021-23382-postcss-regular-expression-denial-of-service-in-previous-map)