PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules     into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*#     sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the     local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can     cause the host process to read any file readable by Node and leak the first ~10 bytes of its content     through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle     and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is     triggered with PostCSS's default options  no from, no map, no plugins required  and is therefore     reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles,     browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers,     etc.). This issue has been fixed in version 8.5.12. (CVE-2026-45623)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules
    into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*#
    sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the
    local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can
    cause the host process to read any file readable by Node and leak the first ~10 bytes of its content
    through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle
    and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is
    triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore
    reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles,
    browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers,
    etc.). This issue has been fixed in version 8.5.12. (CVE-2026-45623)

ID	Name	Product	Family	Type	Severity
330382	Linux Distros Unpatched Vulnerability : CVE-2026-45623	Nessus	Misc.	Local	critical
445210	SCA: security update for postcss (GHSA-6g55-p6wh-862q)	Tenable Cloud Security	SCA Checks	Local	critical
445210	SCA: security update for postcss (GHSA-6g55-p6wh-862q)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-45623

critical

Tenable Plugins

critical

critical

critical