--- id: CVE-2026-69153 title: >- postcss: PostCSS: Information disclosure via crafted sourceMappingURL (CVE-2026-69153) summary: >- A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and exp… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N' cvssSource: vendor cwe: - CWE-22 - CWE-200 vendor: Red Hat product: Red Hat Hardened Images affected: - migration_toolkit_for_containers - node_healthcheck_operator - openshift_lightspeed - openshift_pipelines - amq_broker 7 - ansible_automation_platform 2 - build_of_apache_camel_hawtio 4 - build_of_podman_desktop - connectivity_link 1 - developer_hub - edge_manager 1 - enterprise_linux 9 - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - openshift_container_platform 4 - openshift_data_foundation 4 - openshift_dev_spaces - quay 3 - single_sign_on 7 - trusted_artifact_signer - secrets_management_console_for_red_hat_openshift - streams_for_apache_kafka 2 - enterprise_linux_extensions_channel_v_10 - advanced_cluster_management_for_kubernetes 2.11 - advanced_cluster_management_for_kubernetes 2.13 - advanced_cluster_management_for_kubernetes 2.14 - advanced_cluster_management_for_kubernetes 2.16 - advanced_cluster_management_for_kubernetes 2.17 - ansible_automation_platform 2.1 - ansible_automation_platform 2.2 - discovery 2 - hardened_images - openshift_container_platform 4.22 - openshift_dev_spaces 3.30 - openshift_service_mesh 3.0 - openshift_service_mesh 3.1 - openshift_service_mesh 3.2 - openshift_service_mesh 3.3 - openshift_service_mesh 3.4 - quay 3.15 patched: - enterprise_linux_extensions_channel_v_10 - advanced_cluster_management_for_kubernetes 2.11 - advanced_cluster_management_for_kubernetes 2.13 - advanced_cluster_management_for_kubernetes 2.14 - advanced_cluster_management_for_kubernetes 2.16 - advanced_cluster_management_for_kubernetes 2.17 - ansible_automation_platform 2.1 - ansible_automation_platform 2.2 - discovery 2 - hardened_images - openshift_container_platform 4.22 - openshift_dev_spaces 3.30 - openshift_service_mesh 3.0 - openshift_service_mesh 3.1 - openshift_service_mesh 3.2 - openshift_service_mesh 3.3 - openshift_service_mesh 3.4 - quay 3.15 - streams_for_apache_kafka 3.2.1 - multicluster_engine_for_kubernetes 2.11 - multicluster_engine_for_kubernetes 2.17 - multicluster_engine_for_kubernetes 2.6 - multicluster_engine_for_kubernetes 2.8 - multicluster_engine_for_kubernetes 2.9 published: '2026-08-03' updated: '2026-09-08' sourceUpdated: '2026-09-08T12:16:45+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69153.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69153.json - url: 'https://access.redhat.com/security/cve/CVE-2026-69153' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2510719' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-69153' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69153' - url: >- https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8 - url: 'https://github.com/postcss/postcss/releases/tag/8.5.19' - url: 'https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp' - url: 'https://access.redhat.com/errata/RHSA-2026:57590' - url: 'https://access.redhat.com/errata/RHSA-2026:60387' - url: 'https://access.redhat.com/errata/RHSA-2026:60390' - url: 'https://access.redhat.com/errata/RHSA-2026:60388' - url: 'https://access.redhat.com/errata/RHSA-2026:57191' - url: 'https://access.redhat.com/errata/RHSA-2026:60386' - url: 'https://access.redhat.com/errata/RHSA-2026:56338' - url: 'https://access.redhat.com/errata/RHSA-2026:56357' - url: 'https://access.redhat.com/errata/RHSA-2026:54760' - url: 'https://access.redhat.com/errata/RHSA-2026:50290' - url: 'https://access.redhat.com/errata/RHSA-2026:50079' - url: 'https://access.redhat.com/errata/RHSA-2026:50287' - url: 'https://access.redhat.com/errata/RHSA-2026:50070' - url: 'https://access.redhat.com/errata/RHSA-2026:60441' - url: 'https://access.redhat.com/errata/RHSA-2026:62260' - url: 'https://access.redhat.com/errata/RHSA-2026:59548' - url: 'https://access.redhat.com/errata/RHSA-2026:59561' - url: 'https://access.redhat.com/errata/RHSA-2026:59554' - url: 'https://access.redhat.com/errata/RHSA-2026:59566' - url: 'https://access.redhat.com/errata/RHSA-2026:59583' - url: 'https://access.redhat.com/errata/RHSA-2026:63307' - url: 'https://access.redhat.com/errata/RHSA-2026:54435' - url: 'https://github.com/advisories/GHSA-fxqj-rqcc-2cmp' tags: - csaf - vex - red-hat - ghsa - npm epss: 0.00451 epssPercentile: 0.38562 aliases: - GHSA-fxqj-rqcc-2cmp ecosystem: npm ingestedAt: '2026-08-03T17:27:07.838Z' --- ## Overview A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application's source code. ## Vendor advisories - **RHSA-2026:57590** · Red Hat · fixed in: Red Hat Enterprise Linux Extensions Channel (v. 10) · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57590) - **RHSA-2026:60387** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60387) - **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390) - **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388) - **RHSA-2026:57191** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:57191) - **RHSA-2026:60386** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60386) - **RHSA-2026:56338** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56338) - **RHSA-2026:56357** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-08-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:56357) - **RHSA-2026:54760** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54760) - **RHSA-2026:50290** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50290) - **RHSA-2026:50079** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50079) - **Red Hat VEX** · Important · affected: Migration Toolkit for Containers, Node HealthCheck Operator, OpenShift Lightspeed, OpenShift Pipelines, Red Hat AMQ Broker 7, Red Hat Ansible Automation Platform 2, … · no fix planned: Red Hat Connectivity Link 1, Red Hat Openshift Data Foundation 4, Secrets Management Console for Red Hat OpenShift, Migration Toolkit for Containers, … · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-69153.json) **postcss: PostCSS: Information disclosure via crafted sourceMappingURL** — rated Important by Red Hat. Released 2026-08-03, updated 2026-09-08. Affected: - Migration Toolkit for Containers - Node HealthCheck Operator - OpenShift Lightspeed - OpenShift Pipelines - Red Hat AMQ Broker 7 - Red Hat Ansible Automation Platform 2 - Red Hat build of Apache Camel - HawtIO 4 - Red Hat Build of Podman Desktop - Red Hat Connectivity Link 1 - Red Hat Developer Hub - Red Hat Edge Manager 1 - Red Hat Enterprise Linux 9 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Red Hat Openshift Data Foundation 4 - Red Hat OpenShift Dev Spaces - Red Hat Quay 3 - Red Hat Single Sign-On 7 - Red Hat Trusted Artifact Signer - Secrets Management Console for Red Hat OpenShift - streams for Apache Kafka 2 Fixed: - Red Hat Enterprise Linux Extensions Channel (v. 10) - Red Hat Advanced Cluster Management for Kubernetes 2.11 - Red Hat Advanced Cluster Management for Kubernetes 2.13 - Red Hat Advanced Cluster Management for Kubernetes 2.14 - Red Hat Advanced Cluster Management for Kubernetes 2.16 - Red Hat Advanced Cluster Management for Kubernetes 2.17 - Red Hat Ansible Automation Platform 2.1 - Red Hat Ansible Automation Platform 2.2 - Red Hat Discovery 2 - Red Hat Hardened Images - Red Hat OpenShift Container Platform 4.22 - Red Hat OpenShift Dev Spaces 3.30 - Red Hat OpenShift Service Mesh 3.0 - Red Hat OpenShift Service Mesh 3.1 - Red Hat OpenShift Service Mesh 3.2 - Red Hat OpenShift Service Mesh 3.3 - Red Hat OpenShift Service Mesh 3.4 - Red Hat Quay 3.15 - Streams for Apache Kafka 3.2.1 - multicluster engine for Kubernetes 2.11 - multicluster engine for Kubernetes 2.17 - multicluster engine for Kubernetes 2.6 - multicluster engine for Kubernetes 2.8 - multicluster engine for Kubernetes 2.9 No fix planned: - Red Hat Connectivity Link 1 - Red Hat Openshift Data Foundation 4 - Secrets Management Console for Red Hat OpenShift - Migration Toolkit for Containers - Node HealthCheck Operator - OpenShift Lightspeed - OpenShift Pipelines - Red Hat AMQ Broker 7 - Red Hat Ansible Automation Platform 2 - Red Hat build of Apache Camel - HawtIO 4 - Red Hat Build of Podman Desktop - Red Hat Developer Hub - Red Hat Edge Manager 1 - Red Hat Enterprise Linux 9 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Dev Spaces - Red Hat Quay 3 - Red Hat Single Sign-On 7 - Red Hat Trusted Artifact Signer - streams for Apache Kafka 2 Not affected: - Red Hat Advanced Cluster Management for Kubernetes 2.11 - Red Hat Advanced Cluster Management for Kubernetes 2.13 - Red Hat Advanced Cluster Management for Kubernetes 2.14 - Red Hat Advanced Cluster Management for Kubernetes 2.16 - Red Hat Advanced Cluster Management for Kubernetes 2.17 - Red Hat Discovery 2 - Red Hat OpenShift Container Platform 4.22 - Red Hat OpenShift Dev Spaces 3.30 - Red Hat OpenShift Service Mesh 3.4 - Red Hat Quay 3.15 ## Remediation For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:57590 Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:60387 Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:60390 Workarounds / mitigations: - Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely. ## Package advisory (CVE-2026-69153) Affected packages: - `postcss <= 8.5.22` Patched in: - `postcss 8.5.23` Source: https://github.com/advisories/GHSA-fxqj-rqcc-2cmp