PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-41305 · CVE overview and exploitation status

EUVD-2026-25383

GHSA-qx2v-qp2m-jg93

cve-program · CVE-2026-41305

• https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93
• https://github.com/postcss/postcss/releases/tag/8.5.10

euvd · EUVD-2026-25383

• https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93
• https://github.com/postcss/postcss/releases/tag/8.5.10

nvd · CVE-2026-41305

• https://github.com/postcss/postcss/releases/tag/8.5.10
• https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93

osv · GHSA-qx2v-qp2m-jg93

• https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93
• https://nvd.nist.gov/vuln/detail/CVE-2026-41305
• https://github.com/postcss/postcss
• https://github.com/postcss/postcss/releases/tag/8.5.10

• PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted… · Advisory content revised · 15 Nov 2026