CVE-2026-69153

PostCSS before 8.5.19 contains a path-traversal and information-exposure flaw in PreviousMap.loadFile(): when the 'from' option is unset, the library resolves an attacker-controlled sourceMappingURL without confining it to the CSS file's directory, accepting absolute paths or directory-traversal sequences. An application that parses untrusted CSS under these conditions can be made to read an unintended or attacker-chosen source-map file from the local filesystem. The loaded map's 'sources' and 'sourcesContent' fields, which typically embed original source code and internal file paths, may then be exposed to the application and potentially leaked to the attacker. Any application or build pipeline using PostCSS prior to 8.5.19 to process untrusted CSS with 'from' unset is affected, while deployments that always set 'from' or only handle trusted local CSS are not. No exploitation in the wild is currently reported (EPSS 0.5%, not in CISA KEV), but a public advisory with a proof-of-concept reference is available on the project's GitHub.

What to do: Upgrade PostCSS to 8.5.19 or later and refresh lockfiles/rebuild affected applications and CI pipelines. As an interim mitigation, always set the 'from' option when parsing untrusted CSS, and audit services that accept user-supplied CSS (e.g., online converters or editors) for possible disclosure of source-map contents.