CVE-2026-41305: PostCSS XSS Vulnerability via Unescaped </style> in CSS Stringify Output
Summary
CVE-2026-41305: PostCSS has XSS via Unescaped in its CSS Stringify Output. Affects postcss versions < 8.5.10. Fixed in 8.5.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostCSS is a widely used tool in the web development ecosystem that allows developers to transform CSS with JavaScript plugins. It enables features like autoprefixing, linting, and minification, making CSS more manageable and efficient. However, a vulnerability has been identified in version 8.5.5 that poses a risk of cross-site scripting (XSS) attacks due to improper handling of certain string sequences during the CSS stringification process.
Vulnerability Detail
The vulnerability arises from PostCSS's failure to escape the sequence </style> when stringifying CSS Abstract Syntax Trees (ASTs). This oversight allows user-submitted CSS containing this sequence to break out of the intended style context when embedded in HTML <style> tags. As a result, malicious scripts can be injected and executed in the browser, leading to potential XSS attacks. The issue is particularly concerning for applications that parse and re-stringify user-generated CSS without adequate sanitization.
How To Fix
Latest published version: 8.5.31 as of 22 Oct 2026
npm install postcss@8.5.31Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.5.10
This is the first release that contains the fix.
npm install postcss@8.5.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, a temporary workaround involves escaping the </style> sequence in the output. You can implement the following code snippet to sanitize the output: output =
output.replace(/<\/(style)/gi, '<\\/$1');
This will prevent the closing of the <style> tag and mitigate the risk of XSS.
Conclusion
The vulnerability identified as CVE-2026-41305 in PostCSS poses a significant risk of XSS attacks due to unescaped </style> sequences in CSS stringification. It is crucial for developers using PostCSS to update to version 8.5.10 or later to safeguard their applications. Implementing the provided workaround can offer temporary relief until the update is applied.
See every vulnerability recorded for postcss →
FAQ
The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By analyzing your package-lock.json file, Vulert can alert you to any vulnerabilities, including this one.
The primary impact is the risk of XSS attacks, which can lead to unauthorized script execution, data theft, or other malicious activities on affected web applications.
Yes, you can implement a workaround by escaping the </style> sequence in the CSS output to prevent XSS attacks until you can update to the patched version.
Detailed information can be found in the official advisory on GitHub or by checking the CVE entry for CVE-2026-41305.
Related vulnerabilities
Recent vulnerabilities recorded for postcss.
