{"id":"CVE-2026-73646","title":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree","summary":"PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to joi…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-22"],"published":"2026-08-17","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:05:53.723","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73646","references":[{"url":"https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c","label":"security-advisories@github.com"},{"url":"https://github.com/postcss/postcss/releases/tag/8.5.18","label":"security-advisories@github.com"},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849","label":"security-advisories@github.com"},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73646.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-73646"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517456"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73646"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73646"},{"url":"https://access.redhat.com/errata/RHSA-2026:67538"},{"url":"https://access.redhat.com/errata/RHSA-2026:67540"},{"url":"https://access.redhat.com/errata/RHSA-2026:50287"},{"url":"https://access.redhat.com/errata/RHSA-2026:54520"},{"url":"https://access.redhat.com/errata/RHSA-2026:68681"},{"url":"https://access.redhat.com/errata/RHSA-2026:68754"},{"url":"https://access.redhat.com/errata/RHSA-2026:62260"},{"url":"https://access.redhat.com/errata/RHSA-2026:68756"},{"url":"https://access.redhat.com/errata/RHSA-2026:68765"},{"url":"https://access.redhat.com/errata/RHSA-2026:68748"},{"url":"https://access.redhat.com/errata/RHSA-2026:68750"},{"url":"https://access.redhat.com/errata/RHSA-2026:68755"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00377,"epssPercentile":0.31422,"ingestedAt":"2026-09-18T20:51:25.622Z","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","affected":["node_healthcheck_operator","openshift_pipelines","ansible_automation_platform 2","build_of_apicurio_registry 3","build_of_podman_desktop","ceph_storage 4","enterprise_linux 10","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3","fuse 7","jboss_enterprise_application_platform 7","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_foundation 4","openshift_dev_spaces","openshift_gitops","single_sign_on 7","trusted_artifact_signer","secrets_management_console_for_red_hat_openshift","advanced_cluster_management_for_kubernetes 2.11","advanced_cluster_management_for_kubernetes 2.13","hardened_images","migration_toolkit 1.8","openshift_dev_spaces 3.30","satellite 6.18","satellite 6.19"],"patched":["advanced_cluster_management_for_kubernetes 2.11","advanced_cluster_management_for_kubernetes 2.13","hardened_images","migration_toolkit 1.8","openshift_dev_spaces 3.30","satellite 6.18","satellite 6.19"],"slug":"CVE-2026-73646","body":"## Overview\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:67538** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67538)\n- **RHSA-2026:67540** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67540)\n- **RHSA-2026:50287** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50287)\n- **RHSA-2026:54520** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54520)\n- **RHSA-2026:68681** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68681)\n- **RHSA-2026:68754** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68754)\n- **RHSA-2026:62260** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62260)\n- **RHSA-2026:68756** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68756)\n- **RHSA-2026:68765** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68765)\n- **RHSA-2026:68748** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68748)\n- **RHSA-2026:68750** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68750)\n- **Red Hat VEX** · Important · affected: Node HealthCheck Operator, OpenShift Pipelines, Red Hat Ansible Automation Platform 2, Red Hat build of Apicurio Registry 3, Red Hat Build of Podman Desktop, Red Hat Ceph Storage 4, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Secrets Management Console for Red Hat OpenShift, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73646.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}