Lack of data validation - Path Traversal In node-postcss
Description
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 debian 13 | - | ||
 rpm rhel10 | - | - | |
rpm rhel8 | - | - | |
 npm | 8.5.18 | ||
debian 12 | - | ||
debian 14 | 8.5.19+~cs10.2.23-1 | ||
rpm rhel9 | - | - | |
rpm rhel8 | - | - | |
rpm rhel10 | - | - | |
rpm rhel10 | - | - |
1-10 of 11
10
Aliases
References