The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules     into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*#     sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the     local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can     cause the host process to read any file readable by Node and leak the first ~10 bytes of its content     through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle     and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is     triggered with PostCSS's default options  no from, no map, no plugins required  and is therefore     reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles,     browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers,     etc.). This issue has been fixed in version 8.5.12. (CVE-2026-45623)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-45623

critical Nessus Plugin ID 330382

Version 1.21