# CVE-2026-73646: PostCSS path traversal in source map auto-loading

Source: https://junglewise.ai/threats/cve-2026-73646-postcss-path-traversal-in-source-map-auto-loading  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73646 · Severity: high · CVSS 7.5 · Published 2026-08-17

PostCSS is a popular JavaScript tool that processes CSS files. By default, it automatically attempts to load source map files referenced in CSS comments without proper path validation. An attacker can exploit this by embedding a crafted source map reference (with ../ path traversal sequences or absolute paths) in CSS submitted to an application. This allows reading arbitrary .map files from the server's filesystem and disclosing their contents, potentially exposing sensitive application source code and configuration.

Technologies: [postcss (npm)](https://junglewise.ai/threats/technologies/postcss). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-73646 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73646 being exploited in the wild.

**How severe is CVE-2026-73646?** High severity, with a CVSS score of 7.5, published 17 August 2026.

**Which products and versions are affected?** postcss (npm) SEMVER:introduced=0,fixed=8.5.18.

**Is there a fix for CVE-2026-73646?** Yes. postcss (npm): upgrade to 8.5.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73646 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-73646?** Check whether you run postcss (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- postcss (npm): upgrade to 8.5.18 or later

  ```sh
  npm install postcss@8.5.18
  ```


## Technical details

The vulnerability exists in PostCSS's lib/previous-map.js file (lines 87-98 and 129-144). PostCSS auto-detects /*# sourceMappingURL=... */ comments in CSS and by default (opt-out, not opt-in) attempts to load the referenced path from disk as a "previous source map." The loadMap() function constructs a candidate path using path.join(dirname(opts.from), annotation), where annotation is the raw, untrusted string from the CSS comment. Since path.join() does not sandbox .. segments, an attacker can use ../../../ prefixes to traverse outside the intended directory. A prior fix in version 8.5.12 required the resolved path to end in .map but did not address the traversal logic itself. If opts.from is not set, absolute paths in the CSS comment are read verbatim. The loaded map's sourcesContent field (if present) is merged into result.map and returned to the caller, disclosing the traversed file's contents. Attack requires only the ability to submit CSS text to an application using PostCSS; no authentication or user interaction is required. The fix constrains the resolved path to remain within the CSS file's directory using proper path resolution and verification.

## Affected products

- PostCSS PostCSS <=8.5.17

## Identifiers

- CVE-2026-73646
- GHSA-r28c-9q8g-f849

## Timeline

- 2026-07-24: disclosed
- 2026-07-20: patched: version 8.5.18

## References

- [https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849](https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849)
- [https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c](https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c)

## Related threats

- [PostCSS path traversal in sourceMappingURL parsing](https://junglewise.ai/threats/cve-2026-69153-postcss-path-traversal-in-sourcemappingurl-parsing)
- [PostCSS arbitrary file read via sourceMappingURL path traversal](https://junglewise.ai/threats/cve-2026-45623-postcss-arbitrary-file-read-via-sourcemappingurl-path-traversal)
- [PostCSS has XSS via Unescaped </style> in its CSS Stringify Output](https://junglewise.ai/threats/cve-2026-41305-postcss-has-xss-via-unescaped-style-in-its-css-stringify-output)
- [PostCSS line return parsing error in CSS tokenization](https://junglewise.ai/threats/cve-2023-44270-postcss-line-return-parsing-error-in-css-tokenization)
- [PostCSS regular expression denial of service in previous-map](https://junglewise.ai/threats/cve-2021-23382-postcss-regular-expression-denial-of-service-in-previous-map)