Executive brief
PostCSS, a popular tool for transforming CSS, contains a vulnerability that allows attackers to read sensitive files from the server's filesystem. By submitting a specially crafted CSS file with a malicious source map comment, an attacker can trick the software into loading and disclosing the contents of other files ending in '.map'. This could lead to the exposure of source code or internal configuration data if the application processes untrusted CSS and returns the resulting source map to the user.
Technical details
A path traversal vulnerability exists in PostCSS's source map auto-loading logic within `lib/previous-map.js`. When parsing CSS, PostCSS automatically attempts to load previous source maps defined in `/*# sourceMappingURL=... */` comments. The `loadMap()` function uses `path.join()` on attacker-controlled input without proper sandboxing, allowing an attacker to use `../` sequences to reach files outside the intended directory. While a previous fix restricted file access to those with a `.map` extension, the traversal itself remains unpatched in versions up to 8.5.17. If a traversed-to `.map` file contains a `sourcesContent` field, PostCSS merges this content into the resulting map, which is often returned to the user or written to a public directory, resulting in information disclosure. This is fixed in version 8.5.18.
Affected products
- postcss postcss <= 8.5.17
Timeline
- 2026-07-20: disclosed
- 2026-07-24: advisory
- 2026-07-24: patched: Fixed in version 8.5.18
References
- https://api.github.com/users/alanturing881
- https://github.com/alanturing881
- https://api.github.com/users/alanturing881/gists%7B/gist_id%7D
- https://api.github.com/users/alanturing881/repos
- https://avatars.githubusercontent.com/u/286391906?v=4
- https://api.github.com/users/alanturing881/events%7B/privacy%7D