CVE-2026-45623High· 7.5▾ TwilightA flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can l…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.5%
0.5% → 0.6%
Last analysed / modified upstream
A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifically the first few bytes of file content. Additionally, this vulnerability may be exploited to cause a Denial of Service (DoS) by targeting large files, making the system unavailable.
postcss: PostCSS: Information disclosure and denial of service via crafted CSS input — rated Moderate by Red Hat. Released 2026-07-27, updated 2026-09-08.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:57590 Before you apply this update, make sure all previously released errata that are relevant to your system are applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:60387 Before you apply this update, make sure all previously released errata that are relevant to your system are applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:60390
Affected packages:
postcss <= 8.5.11Patched in:
postcss 8.5.12Connected by shared product, vendor, weakness, or advisory.
CVE-2026-49978High· 8.1dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution (CVE-2026-49978)
CVE-2025-22866Medium· 5.3crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)
CVE-2026-12243High· 7.5nltk: NLTK: Information disclosure via path traversal vulnerability (CVE-2026-12243)
CVE-2026-55685Medium· 6.5react-router: @remix-run/server-runtime: React Router: Denial of Service via unauthenticated manifest endpoint requests (CVE-2026-55685)
CVE-2026-44724High· 7.8systeminformation is a System and OS information library for node.js
CVE-2026-64849High· 8.5mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS …