PostCSS version 8.5.11 and earlier allow an attacker who controls CSS input to embed a sourceMappingURL comment that is parsed and dereferenced against the local file system without validation. The resulting syntax error leaks the first ten bytes of the target file, providing both an information disclosure and a file‑existence oracle. This weakness is classified as CWE‑200 and CWE‑22.

The vulnerability affects the PostCSS library from the postcss:postcss vendor, specifically all releases 8.5.11 and older. The flaw was introduced before 8.5.12 and was fixed in that release.

With a CVSS score of 7.5 the vulnerability is considered high severity, and the EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation. It is not listed in the CISA KEV catalog. An attacker can exploit the flaw by supplying crafted CSS to any pipeline that uses PostCSS with default options, such as CMS theme rendering, user‑style processors, or build systems. The lack of input validation and file‑system checks makes the attack straightforward for an attacker with access to supply CSS, and the resulting read primitive could be combined with large files to trigger a denial‑of‑service.