--- id: CVE-2026-73646 title: >- PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree summary: >- PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to joi… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N' cwe: - CWE-22 published: '2026-08-17' updated: '2026-09-18' sourceUpdated: '2026-09-18T20:05:53.723' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73646' references: - url: >- https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c label: security-advisories@github.com - url: 'https://github.com/postcss/postcss/releases/tag/8.5.18' label: security-advisories@github.com - url: 'https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849' label: security-advisories@github.com - url: 'https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849' label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73646.json - url: 'https://access.redhat.com/security/cve/CVE-2026-73646' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2517456' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-73646' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73646' - url: 'https://access.redhat.com/errata/RHSA-2026:67538' - url: 'https://access.redhat.com/errata/RHSA-2026:67540' - url: 'https://access.redhat.com/errata/RHSA-2026:50287' - url: 'https://access.redhat.com/errata/RHSA-2026:54520' - url: 'https://access.redhat.com/errata/RHSA-2026:68681' - url: 'https://access.redhat.com/errata/RHSA-2026:68754' - url: 'https://access.redhat.com/errata/RHSA-2026:62260' - url: 'https://access.redhat.com/errata/RHSA-2026:68756' - url: 'https://access.redhat.com/errata/RHSA-2026:68765' - url: 'https://access.redhat.com/errata/RHSA-2026:68748' - url: 'https://access.redhat.com/errata/RHSA-2026:68750' - url: 'https://access.redhat.com/errata/RHSA-2026:68755' - url: 'https://access.redhat.com/errata/RHSA-2026:70829' tags: - nvd - csaf - vex - red-hat epss: 0.00377 epssPercentile: 0.31566 ingestedAt: '2026-09-18T20:51:25.622Z' vendor: Red Hat product: Red Hat Enterprise Linux 8 affected: - node_healthcheck_operator - openshift_pipelines - ansible_automation_platform 2 - build_of_apicurio_registry 3 - build_of_podman_desktop - ceph_storage 4 - enterprise_linux 10 - enterprise_linux 7 - enterprise_linux 8 - enterprise_linux 9 - enterprise_linux_ai_rhel_ai 3 - fuse 7 - jboss_enterprise_application_platform 7 - openshift_ai_rhoai - openshift_container_platform 4 - openshift_data_foundation 4 - openshift_dev_spaces - openshift_gitops - single_sign_on 7 - trusted_artifact_signer - secrets_management_console_for_red_hat_openshift - advanced_cluster_management_for_kubernetes 2.11 - advanced_cluster_management_for_kubernetes 2.13 - hardened_images - migration_toolkit 1.8 - openshift_dev_spaces 3.30 - satellite 6.18 - satellite 6.19 patched: - advanced_cluster_management_for_kubernetes 2.11 - advanced_cluster_management_for_kubernetes 2.13 - hardened_images - migration_toolkit 1.8 - openshift_dev_spaces 3.30 - satellite 6.18 - satellite 6.19 --- ## Overview PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:67538** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67538) - **RHSA-2026:67540** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67540) - **RHSA-2026:50287** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50287) - **RHSA-2026:54520** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54520) - **RHSA-2026:68681** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68681) - **RHSA-2026:68754** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68754) - **RHSA-2026:62260** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62260) - **RHSA-2026:68756** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68756) - **RHSA-2026:68765** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68765) - **RHSA-2026:68748** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68748) - **RHSA-2026:68750** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68750) - **Red Hat VEX** · Important · affected: Node HealthCheck Operator, OpenShift Pipelines, Red Hat Ansible Automation Platform 2, Red Hat build of Apicurio Registry 3, Red Hat Build of Podman Desktop, Red Hat Ceph Storage 4, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Secrets Management Console for Red Hat OpenShift, … · updated 2026-09-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73646.json)