PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-69153 · CVE overview and exploitation status

EUVD-2026-52373

GHSA-fxqj-rqcc-2cmp

cve-program · CVE-2026-69153

• https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp
• https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8
• https://github.com/postcss/postcss/releases/tag/8.5.19

euvd · EUVD-2026-52373

• https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp
• https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8
• https://github.com/postcss/postcss/releases/tag/8.5.19

nvd · CVE-2026-69153

• https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8
• https://github.com/postcss/postcss/releases/tag/8.5.19
• https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp

osv · GHSA-fxqj-rqcc-2cmp

• https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp
• https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8
• https://github.com/postcss/postcss
• https://github.com/postcss/postcss/releases/tag/8.5.19

• PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended sourc… · Advisory content revised · 1 Nov 2026