PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2026-41305 node-postcss
- Ubuntu UBUNTU-CVE-2026-41305 node-postcss
Description d'origine La description telle que publiée par la source (souvent en anglais).
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML tags, `` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com