PT-2026-34839 · Postcss · Postcss

Published 2026-04-24 · Updated 2026-05-21 · CVE-2026-41305

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PostCSS versions prior to 8.5.10

Description PostCSS transforms CSS files into an Abstract Syntax Tree (AST) to analyze and modify rules. The software fails to escape </style> sequences when stringifying CSS ASTs. If user-submitted CSS is parsed and then re-stringified for embedding within HTML <style> tags, the </style> sequence in CSS values can break out of the style context, allowing for Cross-Site Scripting (XSS).

Recommendations Update to version 8.5.10.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-41305

GHSA-QX2V-QP2M-JG93

Affected Products

Postcss

References · 12

• 🔥 https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2026-41305 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41305 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-41305 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41305 · Security Note
• https://ubuntu.com/security/CVE-2026-41305 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41305 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41305 · Security Note
• https://github.com/postcss/postcss/releases/tag/8.5.10 · Note
• https://github.com/postcss/postcss · Note
• https://twitter.com/CVEnew/status/2048099330507055471 · Twitter Post