{"id":"CVE-2026-69153","title":"postcss: PostCSS: Information disclosure via crafted sourceMappingURL (CVE-2026-69153)","summary":"A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and exp…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":["CWE-22","CWE-200"],"vendor":"Red Hat","product":"Red Hat Hardened Images","affected":["migration_toolkit_for_containers","node_healthcheck_operator","openshift_lightspeed","openshift_pipelines","amq_broker 7","ansible_automation_platform 2","build_of_apache_camel_hawtio 4","build_of_podman_desktop","connectivity_link 1","developer_hub","edge_manager 1","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_foundation 4","openshift_dev_spaces","quay 3","single_sign_on 7","trusted_artifact_signer","secrets_management_console_for_red_hat_openshift","streams_for_apache_kafka 2","enterprise_linux_extensions_channel_v_10","advanced_cluster_management_for_kubernetes 2.11","advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.14","advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17","ansible_automation_platform 2.1","ansible_automation_platform 2.2","discovery 2","hardened_images","openshift_container_platform 4.22","openshift_dev_spaces 3.30","openshift_service_mesh 3.0","openshift_service_mesh 3.1","openshift_service_mesh 3.2","openshift_service_mesh 3.3","openshift_service_mesh 3.4","quay 3.15"],"patched":["enterprise_linux_extensions_channel_v_10","advanced_cluster_management_for_kubernetes 2.11","advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.14","advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17","ansible_automation_platform 2.1","ansible_automation_platform 2.2","discovery 2","hardened_images","openshift_container_platform 4.22","openshift_dev_spaces 3.30","openshift_service_mesh 3.0","openshift_service_mesh 3.1","openshift_service_mesh 3.2","openshift_service_mesh 3.3","openshift_service_mesh 3.4","quay 3.15","streams_for_apache_kafka 3.2.1","multicluster_engine_for_kubernetes 2.11","multicluster_engine_for_kubernetes 2.17","multicluster_engine_for_kubernetes 2.6","multicluster_engine_for_kubernetes 2.8","multicluster_engine_for_kubernetes 2.9"],"published":"2026-08-03","updated":"2026-09-08","sourceUpdated":"2026-09-08T12:16:45+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69153.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69153.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-69153"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510719"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69153"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69153"},{"url":"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.19"},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"},{"url":"https://access.redhat.com/errata/RHSA-2026:57590"},{"url":"https://access.redhat.com/errata/RHSA-2026:60387"},{"url":"https://access.redhat.com/errata/RHSA-2026:60390"},{"url":"https://access.redhat.com/errata/RHSA-2026:60388"},{"url":"https://access.redhat.com/errata/RHSA-2026:57191"},{"url":"https://access.redhat.com/errata/RHSA-2026:60386"},{"url":"https://access.redhat.com/errata/RHSA-2026:56338"},{"url":"https://access.redhat.com/errata/RHSA-2026:56357"},{"url":"https://access.redhat.com/errata/RHSA-2026:54760"},{"url":"https://access.redhat.com/errata/RHSA-2026:50290"},{"url":"https://access.redhat.com/errata/RHSA-2026:50079"},{"url":"https://access.redhat.com/errata/RHSA-2026:50287"},{"url":"https://access.redhat.com/errata/RHSA-2026:50070"},{"url":"https://access.redhat.com/errata/RHSA-2026:60441"},{"url":"https://access.redhat.com/errata/RHSA-2026:62260"},{"url":"https://access.redhat.com/errata/RHSA-2026:59548"},{"url":"https://access.redhat.com/errata/RHSA-2026:59561"},{"url":"https://access.redhat.com/errata/RHSA-2026:59554"},{"url":"https://access.redhat.com/errata/RHSA-2026:59566"},{"url":"https://access.redhat.com/errata/RHSA-2026:59583"},{"url":"https://access.redhat.com/errata/RHSA-2026:63307"},{"url":"https://access.redhat.com/errata/RHSA-2026:54435"},{"url":"https://github.com/advisories/GHSA-fxqj-rqcc-2cmp"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.00451,"epssPercentile":0.38432,"aliases":["GHSA-fxqj-rqcc-2cmp"],"ecosystem":"npm","ingestedAt":"2026-08-03T17:27:07.838Z","slug":"CVE-2026-69153","body":"## Overview\n\nA flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application's source code.\n\n## Vendor advisories\n\n- **RHSA-2026:57590** · Red Hat · fixed in: Red Hat Enterprise Linux Extensions Channel (v. 10) · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57590)\n- **RHSA-2026:60387** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60387)\n- **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390)\n- **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388)\n- **RHSA-2026:57191** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:57191)\n- **RHSA-2026:60386** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60386)\n- **RHSA-2026:56338** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56338)\n- **RHSA-2026:56357** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56357)\n- **RHSA-2026:54760** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54760)\n- **RHSA-2026:50290** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50290)\n- **RHSA-2026:50079** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50079)\n- **Red Hat VEX** · Important · affected: Migration Toolkit for Containers, Node HealthCheck Operator, OpenShift Lightspeed, OpenShift Pipelines, Red Hat AMQ Broker 7, Red Hat Ansible Automation Platform 2, … · no fix planned: Red Hat Connectivity Link 1, Red Hat Openshift Data Foundation 4, Secrets Management Console for Red Hat OpenShift, Migration Toolkit for Containers, … · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69153.json)\n\n**postcss: PostCSS: Information disclosure via crafted sourceMappingURL** — rated Important by Red Hat. Released 2026-08-03, updated 2026-09-08.\n\nAffected:\n\n- Migration Toolkit for Containers\n- Node HealthCheck Operator\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- Red Hat AMQ Broker 7\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat Build of Podman Desktop\n- Red Hat Connectivity Link 1\n- Red Hat Developer Hub\n- Red Hat Edge Manager 1\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat Quay 3\n- Red Hat Single Sign-On 7\n- Red Hat Trusted Artifact Signer\n- Secrets Management Console for Red Hat OpenShift\n- streams for Apache Kafka 2\n\nFixed:\n\n- Red Hat Enterprise Linux Extensions Channel (v. 10)\n- Red Hat Advanced Cluster Management for Kubernetes 2.11\n- Red Hat Advanced Cluster Management for Kubernetes 2.13\n- Red Hat Advanced Cluster Management for Kubernetes 2.14\n- Red Hat Advanced Cluster Management for Kubernetes 2.16\n- Red Hat Advanced Cluster Management for Kubernetes 2.17\n- Red Hat Ansible Automation Platform 2.1\n- Red Hat Ansible Automation Platform 2.2\n- Red Hat Discovery 2\n- Red Hat Hardened Images\n- Red Hat OpenShift Container Platform 4.22\n- Red Hat OpenShift Dev Spaces 3.30\n- Red Hat OpenShift Service Mesh 3.0\n- Red Hat OpenShift Service Mesh 3.1\n- Red Hat OpenShift Service Mesh 3.2\n- Red Hat OpenShift Service Mesh 3.3\n- Red Hat OpenShift Service Mesh 3.4\n- Red Hat Quay 3.15\n- Streams for Apache Kafka 3.2.1\n- multicluster engine for Kubernetes 2.11\n- multicluster engine for Kubernetes 2.17\n- multicluster engine for Kubernetes 2.6\n- multicluster engine for Kubernetes 2.8\n- multicluster engine for Kubernetes 2.9\n\nNo fix planned:\n\n- Red Hat Connectivity Link 1\n- Red Hat Openshift Data Foundation 4\n- Secrets Management Console for Red Hat OpenShift\n- Migration Toolkit for Containers\n- Node HealthCheck Operator\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- Red Hat AMQ Broker 7\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat Build of Podman Desktop\n- Red Hat Developer Hub\n- Red Hat Edge Manager 1\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat Quay 3\n- Red Hat Single Sign-On 7\n- Red Hat Trusted Artifact Signer\n- streams for Apache Kafka 2\n\nNot affected:\n\n- Red Hat Advanced Cluster Management for Kubernetes 2.11\n- Red Hat Advanced Cluster Management for Kubernetes 2.13\n- Red Hat Advanced Cluster Management for Kubernetes 2.14\n- Red Hat Advanced Cluster Management for Kubernetes 2.16\n- Red Hat Advanced Cluster Management for Kubernetes 2.17\n- Red Hat Discovery 2\n- Red Hat OpenShift Container Platform 4.22\n- Red Hat OpenShift Dev Spaces 3.30\n- Red Hat OpenShift Service Mesh 3.4\n- Red Hat Quay 3.15\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:57590\nBefore you apply this update, make sure all previously released errata\nthat are relevant to your system are applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:60387\nBefore you apply this update, make sure all previously released errata\nthat are relevant to your system are applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:60390\n\nWorkarounds / mitigations:\n\n- Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely.\n\n## Package advisory (CVE-2026-69153)\n\nAffected packages:\n\n- `postcss <= 8.5.22`\n\nPatched in:\n\n- `postcss 8.5.23`\n\nSource: https://github.com/advisories/GHSA-fxqj-rqcc-2cmp","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":5439,"id":"CVE-2026-69153","ts":1788887282640,"field":"cvss","old":null,"new":"7.5"},{"seq":5438,"id":"CVE-2026-69153","ts":1788887282640,"field":"severity","old":"medium","new":"high"},{"seq":4322,"id":"CVE-2026-69153","ts":1788886396371,"field":"cvss","old":"7.5","new":null},{"seq":4321,"id":"CVE-2026-69153","ts":1788886396371,"field":"severity","old":"high","new":"medium"},{"seq":3202,"id":"CVE-2026-69153","ts":1788883133596,"field":"cvss","old":null,"new":"7.5"},{"seq":3201,"id":"CVE-2026-69153","ts":1788883133596,"field":"severity","old":"medium","new":"high"}]}