Security vulnerabilities and automated fixes for postcss issues
3 posts found
A high-severity prototype pollution vulnerability (CVE-2020-8203) was identified in the lodash library via the `zipObjectDeep` function, present as a transitive dependency through postcss in the project's `yarn.lock`. The fix upgrades postcss from 8.5.8 to 8.5.12 using a Yarn resolution override, eliminating the vulnerable lodash code path and reducing the attack surface against crafted CSS input. This change protects the application from object prototype manipulation that could lead to informat
A high-severity vulnerability in PostCSS (CVE-2026-45623) allowed attackers to craft malicious CSS input containing a manipulated `sourceMappingURL` comment to trigger arbitrary file reads and information disclosure. The vulnerability affected `AdminPanel-Vue/package-lock.json` via the `postcss` dependency pinned at version `8.5.8`, and was resolved by upgrading to `8.5.12` with an explicit `overrides` entry in `package.json` to enforce the safe version across the entire dependency tree.
A high-severity path traversal vulnerability (GHSA-r28c-9q8g-f849) in PostCSS versions prior to 8.5.18 allowed attackers to abuse the `sourceMappingURL` comment auto-loading mechanism to read arbitrary `.map` files outside the intended directory. The fix upgrades PostCSS from 8.5.15 to 8.5.18 in `frontend/package-lock.json` and pins the version via an `overrides` block in `frontend/package.json`. This closes a file disclosure primitive that, while not independently exploitable in all configurati