Path Traversal Vulnerability in PostCSS Leading to Arbitrary .map File Disclosure
Summary
GHSA-r28c-9q8g-f849: Vulnerability Details File: lib/previous-map.js Line: 87-98 (loadFile), 129-144 (loadMap) Root Cause PostCSS auto-detects a /*# sourceMappingURL=... Affects postcss versions < 8.5.18. Fixed in 8.5.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostCSS is a widely used tool in the JavaScript ecosystem that allows developers to transform CSS with JavaScript plugins. It provides features such as linting, formatting, and transforming CSS code. However, a vulnerability exists in PostCSS that allows attackers to exploit the auto-loading of source maps, potentially disclosing sensitive information from arbitrary files on the server.
Vulnerability Detail
The vulnerability arises from PostCSS's handling of source maps through the 'sourceMappingURL' comment in CSS files. When a CSS file is processed, PostCSS attempts to load the specified source map file from the filesystem. If the source map path contains traversal sequences (e.g., '../'), it can lead to unauthorized access to files outside the intended directory. This can result in the disclosure of sensitive information contained in .map files, as the loaded map's content may be merged into the output, exposing it to the attacker. The vulnerability affects any application that processes untrusted CSS without explicitly disabling source map generation.
How To Fix
Latest published version: 8.5.31 as of 22 Oct 2026
npm install postcss@8.5.31Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.5.18
This is the first release that contains the fix.
npm install postcss@8.5.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable source map generation by setting the 'map' option to false when processing CSS: 'postcss().process(userCss, { from: '/app/uploads/user123/input.css', to: '/app/uploads/user123/output.css', map: false })'. This will prevent any source maps from being loaded and mitigate the risk of disclosure.
Conclusion
The path traversal vulnerability in PostCSS poses a significant risk to applications that process untrusted CSS. By updating to the patched version (8.5.18) and implementing the recommended workarounds, developers can mitigate the risk of unauthorized file access and protect sensitive information.
See every vulnerability recorded for postcss →
FAQ
The vulnerability allows for path traversal, enabling attackers to access arbitrary .map files on the server by manipulating the sourceMappingURL in CSS.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can alert you to any vulnerabilities, including this one.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Yes, you can temporarily disable source map generation by setting the 'map' option to false in your PostCSS processing configuration.
If exploited, this vulnerability can lead to the disclosure of sensitive information from .map files, which may contain source code or other confidential data.
References
Related vulnerabilities
Recent vulnerabilities recorded for postcss.
