PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-41305 node-postcss
- Ubuntu UBUNTU-CVE-2026-41305 node-postcss
Original description The description as published by the source.
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML tags, `` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com