{"id":"CVE-2026-45623","title":"postcss: PostCSS: Information disclosure and denial of service via crafted CSS input (CVE-2026-45623)","summary":"A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can l…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":["CWE-22","CWE-200"],"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","affected":["migration_toolkit_for_containers","node_healthcheck_operator","openshift_lightspeed","openshift_pipelines","ansible_automation_platform 2","build_of_podman_desktop","enterprise_linux 10","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","openshift_container_platform 4","openshift_dev_spaces","satellite 6","trusted_artifact_signer","secrets_management_console_for_red_hat_openshift","enterprise_linux_extensions_channel_v_10","advanced_cluster_management_for_kubernetes 2.11","advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.14","advanced_cluster_management_for_kubernetes 2.15","advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17","ansible_automation_platform 2.1","ansible_automation_platform 2.2","discovery 2","openshift_ai 3.4","openshift_container_platform 4.22","openshift_dev_spaces 3.30","openshift_service_mesh 3.0","openshift_service_mesh 3.1","openshift_service_mesh 3.2","openshift_service_mesh 3.3","openshift_service_mesh 3.4","satellite 6.18","satellite 6.19","multicluster_engine_for_kubernetes 2.11","multicluster_engine_for_kubernetes 2.17","multicluster_engine_for_kubernetes 2.8"],"patched":["enterprise_linux_extensions_channel_v_10","advanced_cluster_management_for_kubernetes 2.11","advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.14","advanced_cluster_management_for_kubernetes 2.15","advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17","ansible_automation_platform 2.1","ansible_automation_platform 2.2","discovery 2","openshift_ai 3.4","openshift_container_platform 4.22","openshift_dev_spaces 3.30","openshift_service_mesh 3.0","openshift_service_mesh 3.1","openshift_service_mesh 3.2","openshift_service_mesh 3.3","openshift_service_mesh 3.4","satellite 6.18","satellite 6.19","multicluster_engine_for_kubernetes 2.11","multicluster_engine_for_kubernetes 2.17","multicluster_engine_for_kubernetes 2.8","multicluster_engine_for_kubernetes 2.9"],"published":"2026-07-27","updated":"2026-09-08","sourceUpdated":"2026-09-08T13:36:03+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45623.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45623.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-45623"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507595"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45623"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45623"},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q"},{"url":"https://access.redhat.com/errata/RHSA-2026:57590"},{"url":"https://access.redhat.com/errata/RHSA-2026:60387"},{"url":"https://access.redhat.com/errata/RHSA-2026:60390"},{"url":"https://access.redhat.com/errata/RHSA-2026:60388"},{"url":"https://access.redhat.com/errata/RHSA-2026:54427"},{"url":"https://access.redhat.com/errata/RHSA-2026:57191"},{"url":"https://access.redhat.com/errata/RHSA-2026:60386"},{"url":"https://access.redhat.com/errata/RHSA-2026:56338"},{"url":"https://access.redhat.com/errata/RHSA-2026:56357"},{"url":"https://access.redhat.com/errata/RHSA-2026:61783"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"url":"https://access.redhat.com/errata/RHSA-2026:60441"},{"url":"https://access.redhat.com/errata/RHSA-2026:62260"},{"url":"https://access.redhat.com/errata/RHSA-2026:59548"},{"url":"https://access.redhat.com/errata/RHSA-2026:59561"},{"url":"https://access.redhat.com/errata/RHSA-2026:59554"},{"url":"https://access.redhat.com/errata/RHSA-2026:59566"},{"url":"https://access.redhat.com/errata/RHSA-2026:59583"},{"url":"https://access.redhat.com/errata/RHSA-2026:63373"},{"url":"https://access.redhat.com/errata/RHSA-2026:63355"},{"url":"https://access.redhat.com/errata/RHSA-2026:57194"},{"url":"https://access.redhat.com/errata/RHSA-2026:59593"},{"url":"https://access.redhat.com/errata/RHSA-2026:59558"},{"url":"https://access.redhat.com/errata/RHSA-2026:59559"},{"url":"https://github.com/postcss/postcss/commit/aaec7b78b3ce2792585b4b300ef1bd5dd5b3e8ad"},{"url":"https://github.com/postcss/postcss/commit/c64b7488d2731dfa16213739b42c34faf5a9eba3"},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.12"},{"url":"https://github.com/advisories/GHSA-6g55-p6wh-862q"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.00587,"epssPercentile":0.46478,"aliases":["GHSA-6g55-p6wh-862q"],"ecosystem":"npm","ingestedAt":"2026-07-23T15:18:37.997Z","slug":"CVE-2026-45623","body":"## Overview\n\nA flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifically the first few bytes of file content. Additionally, this vulnerability may be exploited to cause a Denial of Service (DoS) by targeting large files, making the system unavailable.\n\n## Vendor advisories\n\n- **RHSA-2026:57590** · Red Hat · fixed in: Red Hat Enterprise Linux Extensions Channel (v. 10) · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57590)\n- **RHSA-2026:60387** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60387)\n- **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390)\n- **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388)\n- **RHSA-2026:54427** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54427)\n- **RHSA-2026:57191** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:57191)\n- **RHSA-2026:60386** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60386)\n- **RHSA-2026:56338** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56338)\n- **RHSA-2026:56357** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56357)\n- **RHSA-2026:61783** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61783)\n- **RHSA-2026:60520** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-08-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:60520)\n- **Red Hat VEX** · Moderate · affected: Migration Toolkit for Containers, Node HealthCheck Operator, OpenShift Lightspeed, OpenShift Pipelines, Red Hat Ansible Automation Platform 2, Red Hat Build of Podman Desktop, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Secrets Management Console for Red Hat OpenShift, … · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45623.json)\n\n**postcss: PostCSS: Information disclosure and denial of service via crafted CSS input** — rated Moderate by Red Hat. Released 2026-07-27, updated 2026-09-08.\n\nAffected:\n\n- Migration Toolkit for Containers\n- Node HealthCheck Operator\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- Red Hat Ansible Automation Platform 2\n- Red Hat Build of Podman Desktop\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat Satellite 6\n- Red Hat Trusted Artifact Signer\n- Secrets Management Console for Red Hat OpenShift\n\nFixed:\n\n- Red Hat Enterprise Linux Extensions Channel (v. 10)\n- Red Hat Advanced Cluster Management for Kubernetes 2.11\n- Red Hat Advanced Cluster Management for Kubernetes 2.13\n- Red Hat Advanced Cluster Management for Kubernetes 2.14\n- Red Hat Advanced Cluster Management for Kubernetes 2.15\n- Red Hat Advanced Cluster Management for Kubernetes 2.16\n- Red Hat Advanced Cluster Management for Kubernetes 2.17\n- Red Hat Ansible Automation Platform 2.1\n- Red Hat Ansible Automation Platform 2.2\n- Red Hat Discovery 2\n- Red Hat OpenShift AI 3.4\n- Red Hat OpenShift Container Platform 4.22\n- Red Hat OpenShift Dev Spaces 3.30\n- Red Hat OpenShift Service Mesh 3.0\n- Red Hat OpenShift Service Mesh 3.1\n- Red Hat OpenShift Service Mesh 3.2\n- Red Hat OpenShift Service Mesh 3.3\n- Red Hat OpenShift Service Mesh 3.4\n- Red Hat Satellite 6.18\n- Red Hat Satellite 6.19\n- multicluster engine for Kubernetes 2.11\n- multicluster engine for Kubernetes 2.17\n- multicluster engine for Kubernetes 2.8\n- multicluster engine for Kubernetes 2.9\n\nNo fix planned:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Secrets Management Console for Red Hat OpenShift\n- Migration Toolkit for Containers\n- Node HealthCheck Operator\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- Red Hat Build of Podman Desktop\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat Satellite 6\n- Red Hat Trusted Artifact Signer\n\nNot affected:\n\n- Red Hat Advanced Cluster Management for Kubernetes 2.11\n- Red Hat Advanced Cluster Management for Kubernetes 2.13\n- Red Hat Advanced Cluster Management for Kubernetes 2.14\n- Red Hat Advanced Cluster Management for Kubernetes 2.15\n- Red Hat Advanced Cluster Management for Kubernetes 2.16\n- Red Hat Advanced Cluster Management for Kubernetes 2.17\n- Red Hat Discovery 2\n- Red Hat OpenShift AI 3.4\n- Red Hat OpenShift Container Platform 4.22\n- Red Hat OpenShift Dev Spaces 3.30\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:57590\nBefore you apply this update, make sure all previously released errata\nthat are relevant to your system are applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:60387\nBefore you apply this update, make sure all previously released errata\nthat are relevant to your system are applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:60390\n\n## Package advisory (CVE-2026-45623)\n\nAffected packages:\n\n- `postcss <= 8.5.11`\n\nPatched in:\n\n- `postcss 8.5.12`\n\nSource: https://github.com/advisories/GHSA-6g55-p6wh-862q","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}