PostCSS transforms CSS into an abstract syntax tree and can load source maps via the sourceMappingURL header. Prior to version 8.5.18, the library concatenated attacker‑controlled sourceMappingURL values with the directory of the input file, then opened the resulting path without validating or restricting it. This path traversal flaw allowed an attacker to supply a malicious sourceMappingURL that points to an arbitrary .map file on the system, causing PostCSS to read and expose the file’s contents through the result.map object. The vulnerability is fixed in version 8.5.18.

PostCSS (postcss:postcss) versions older than 8.5.18 are vulnerable, regardless of the build or deployment platform, as the flaw resides in the core library code.

The CVSS score of 7.5 indicates a high severity disclosure flaw. EPSS is not available, so the likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. An attacker who can supply CSS files to a system that processes them with PostCSS can trigger the traversal and read arbitrary source map files, potentially retrieving source code or configuration data stored in those maps. The impact is largely confidentiality damage, with no known denial‑of‑service or privilege‑escalation vector.