Technical impact
PostCSS, a CSS processing library, allows an attacker to control the sourceMappingURL of a source map. When the "from" attribute is omitted, the previousMap.loadFile() method will read the file specified by sourceMappingURL, even if that path is absolute or contains path‑traversal sequences. The loaded map's sources and sourcesContent properties may expose arbitrary files to the application, leading to disclosure of sensitive information. The issue is fixed in version 8.5.19.
Affected Systems
All installations of the PostCSS library that are earlier than version 8.5.19. The vulnerability affects the postcss:postcss product, commonly used in build tools, front‑end frameworks, and web applications that import the library to process CSS.
Risk and Exploitability
The vulnerability is exploitable by supplying a crafted CSS file to a vulnerable application. An attacker does not need elevated privileges; the library will perform a file read based on the supplied path, which may access files on the host file system that are readable by the process. Because the CVSS score is 6.3, the risk is moderate, and the absence of an EPSS or KEV listing indicates no known active exploitation. However, the ability to read arbitrary files can still be valuable to an attacker, especially if the application can then use the contents to deanonymize users or access restricted data.
Github GHSA