CVE-2026-69153

Katalog CVE

CVSS 5.3 · Medium EPSS 0,45%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada postcss. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.

Rincian

Terbit di NVD

3 Agustus 2026

Terakhir diubah

5 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp exploit · mitigasi · advisory vendor
• https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8 patch
• https://github.com/postcss/postcss/releases/tag/8.5.19 product · release notes