Nixpkgs security tracker
Permalink
CVE-2026-41305
6.1 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): REQUIRED
- Scope (S): CHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): LOW
- Availability impact (A): NONE
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
2 packages
- nodePackages.postcss
- nodePackages_latest.postcss
-
@LeSuisse
restored
2 packages
- nodePackages.postcss
- nodePackages_latest.postcss
- @LeSuisse accepted
- @LeSuisse published on GitHub
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.
References
-
https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93 exploitx_refsource_CONFIRM
Ignored references (1)
-
https://github.com/postcss/postcss/releases/tag/8.5.10 x_refsource_MISC
Affected products
postcss
- ==< 8.5.10
Matching in nixpkgs
pkgs.postcss
Transforming styles with JS plugins
pkgs.nodePackages.postcss
Tool for transforming styles with JS plugins
pkgs.nodePackages_latest.postcss
Tool for transforming styles with JS plugins