CVE-2026-69153 (Medium) detected in postcss-8.4.31.tgz

[mend-bolt-for-github]

CVE-2026-69153 - Medium Severity Vulnerability

Vulnerable Library - postcss-8.4.31.tgz

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json,/node_modules/postcss/package.json

Dependency Hierarchy:

• muon-0.0.2-beta.64.tgz (Root Library)
  • ❌ postcss-8.4.31.tgz (Vulnerable Library)

Found in HEAD commit: f62742a486a7acc9074524b4461667e5e1e3ed9f

Found in base branch: main

Vulnerability Details

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.

Publish Date: 2026-08-03

URL: CVE-2026-69153

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-03

Fix Resolution: https://github.com/postcss/postcss.git - 8.5.23

---

Step up your Open Source Security Game with Mend here