FazBrowse GitHub Viewer | Trending | | Home

Tools: [Download Repo ZIP] [Original HTTPS Page]

Overview · postcss/postcss · GitHub

Security

Report a vulnerability

docs/SECURITY.md

Security Policy

Supported Versions

Only the latest release is supported.

Version	Supported
8.5.x	✅
< 8.5.x	❌

After releasing new major version, we support old major for a year.

Reporting a Vulnerability

To report a security vulnerability, please use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
GHSA-fxqj-rqcc-2cmp published Jul 24, 2026 by ai

Moderate
Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
GHSA-r28c-9q8g-f849 published Jul 20, 2026 by ai

High
Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
GHSA-6g55-p6wh-862q published Jul 20, 2026 by ai

High
XSS via Unescaped </style> in CSS Stringify Output
GHSA-qx2v-qp2m-jg93 published Apr 20, 2026 by ai

Moderate

Learn more about advisories related to postcss/postcss in the GitHub Advisory Database

Back | FazBrowse Home | New Git URL