PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset (CVE-2026-69153)
PostCSS versions prior to 8.5.23 contain a vulnerability where an incomplete fix for a previous sourceMappingURL issue allows an attacker to read arbitrary .map files when the `from` option is not set. This occurs because path traversal and absolute path checks are skipped if the base CSS file is undefined, enabling disclosure of local filesystem paths and source contents from attacker-controlled source map files. The vulnerability is limited to files ending with a .map extension that parse as JSON. A patch is available to address this issue.
AI Analysis
Technical Summary
The vulnerability in PostCSS (CVE-2026-69153) arises from an incomplete fix for GHSA-6g55-p6wh-862q. The fix added checks to restrict attacker-controlled sourceMappingURL paths to .map files and prevent directory traversal or absolute path usage, but these checks only apply when the `from` option is set (i.e., when the CSS file path is known). When PostCSS is invoked without the `from` option, the traversal and absolute path checks are skipped, allowing an attacker to specify an absolute or relative path to any .map file on the filesystem. If the file is valid JSON, its `sources` and `sourcesContent` fields are disclosed in the generated source map. This can lead to unintended disclosure of sensitive source code or filesystem paths. The issue affects PostCSS versions before 8.5.23, which include the original partial fix. The recommended fix is to apply traversal and absolute path restrictions regardless of the presence of a base CSS file path.
Potential Impact
An attacker can cause PostCSS to read and disclose arbitrary .map files on the local filesystem when processing attacker-controlled CSS without specifying the `from` option. This leads to exposure of local filesystem paths and source code contents embedded in those .map files. The vulnerability is limited to .map files that parse as JSON and only occurs if the consumer exposes the generated source map (e.g., online CSS playgrounds, minify or lint services, or build steps processing string input). There is no indication of remote code execution or privilege escalation. No known exploits in the wild have been reported.
Mitigation Recommendations
A patch is available that fixes this vulnerability by enforcing directory traversal and absolute path restrictions on untrusted sourceMappingURL paths regardless of whether the `from` option is set. Users should upgrade PostCSS to version 8.5.23 or later. Until patched, avoid processing attacker-controlled CSS without specifying the `from` option or exposing the resulting source map. The vendor advisory confirms a fix is available; apply the official update to remediate this issue.
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset (CVE-2026-69153)
Description
PostCSS versions prior to 8.5.23 contain a vulnerability where an incomplete fix for a previous sourceMappingURL issue allows an attacker to read arbitrary .map files when the `from` option is not set. This occurs because path traversal and absolute path checks are skipped if the base CSS file is undefined, enabling disclosure of local filesystem paths and source contents from attacker-controlled source map files. The vulnerability is limited to files ending with a .map extension that parse as JSON. A patch is available to address this issue.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in PostCSS (CVE-2026-69153) arises from an incomplete fix for GHSA-6g55-p6wh-862q. The fix added checks to restrict attacker-controlled sourceMappingURL paths to .map files and prevent directory traversal or absolute path usage, but these checks only apply when the `from` option is set (i.e., when the CSS file path is known). When PostCSS is invoked without the `from` option, the traversal and absolute path checks are skipped, allowing an attacker to specify an absolute or relative path to any .map file on the filesystem. If the file is valid JSON, its `sources` and `sourcesContent` fields are disclosed in the generated source map. This can lead to unintended disclosure of sensitive source code or filesystem paths. The issue affects PostCSS versions before 8.5.23, which include the original partial fix. The recommended fix is to apply traversal and absolute path restrictions regardless of the presence of a base CSS file path.
Potential Impact
An attacker can cause PostCSS to read and disclose arbitrary .map files on the local filesystem when processing attacker-controlled CSS without specifying the `from` option. This leads to exposure of local filesystem paths and source code contents embedded in those .map files. The vulnerability is limited to .map files that parse as JSON and only occurs if the consumer exposes the generated source map (e.g., online CSS playgrounds, minify or lint services, or build steps processing string input). There is no indication of remote code execution or privilege escalation. No known exploits in the wild have been reported.
Mitigation Recommendations
A patch is available that fixes this vulnerability by enforcing directory traversal and absolute path restrictions on untrusted sourceMappingURL paths regardless of whether the `from` option is set. Users should upgrade PostCSS to version 8.5.23 or later. Until patched, avoid processing attacker-controlled CSS without specifying the `from` option or exposing the resulting source map. The vendor advisory confirms a fix is available; apply the official update to remediate this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fxqj-rqcc-2cmp
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-69153"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a710664bf32cb7a343946fd
Added to database: 08/03/2026, 21:21:40 UTC
Last enriched: 08/03/2026, 21:31:03 UTC
Last updated: 08/03/2026, 23:45:15 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.