Executive brief
PostCSS is a popular JavaScript tool that processes CSS files. By default, it automatically attempts to load source map files referenced in CSS comments without proper path validation. An attacker can exploit this by embedding a crafted source map reference (with ../ path traversal sequences or absolute paths) in CSS submitted to an application. This allows reading arbitrary .map files from the server's filesystem and disclosing their contents, potentially exposing sensitive application source code and configuration.
Technical details
The vulnerability exists in PostCSS's lib/previous-map.js file (lines 87-98 and 129-144). PostCSS auto-detects /*# sourceMappingURL=... */ comments in CSS and by default (opt-out, not opt-in) attempts to load the referenced path from disk as a "previous source map." The loadMap() function constructs a candidate path using path.join(dirname(opts.from), annotation), where annotation is the raw, untrusted string from the CSS comment. Since path.join() does not sandbox .. segments, an attacker can use ../../../ prefixes to traverse outside the intended directory. A prior fix in version 8.5.12 required the resolved path to end in .map but did not address the traversal logic itself. If opts.from is not set, absolute paths in the CSS comment are read verbatim. The loaded map's sourcesContent field (if present) is merged into result.map and returned to the caller, disclosing the traversed file's contents. Attack requires only the ability to submit CSS text to an application using PostCSS; no authentication or user interaction is required. The fix constrains the resolved path to remain within the CSS file's directory using proper path resolution and verification.
Affected products
- PostCSS PostCSS <=8.5.17
Timeline
- 2026-07-24: disclosed
- 2026-07-20: patched: version 8.5.18