PostCSS versions older than 8.5.10 omit escaping the literal sequence </style> when converting an abstract syntax tree back into CSS text. When user‑supplied CSS is parsed and then re‑stringified for inclusion inside an HTML <style> element, the unescaped sequence ends the style block and allows embedding of arbitrary HTML or JavaScript, thereby creating a classic cross‑site scripting flaw. The weakness is a classic input validation failure (CWE‑79).

The vulnerability affects the PostCSS library (postcss:postcss). All releases prior to 8.5.10 are impacted, as the remediation was introduced in 8.5.10. Systems that parse user CSS with PostCSS and subsequently embed it in page <style> tags are at risk.

The CVSS score of 6.1 places the flaw in the medium severity range. EPSS indicates an exploitation probability of less than 1 percent, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. The likely attack vector is local or remote injection of CSS content that is processed by PostCSS and rendered into a web page; therefore, secure channels that allow arbitrary CSS to be processed by PostCSS and rendered into a web page pose a risk.