Security vulnerabilities and automated fixes for postcss issues
2 posts found
A path traversal vulnerability in PostCSS versions before 8.5.18 allowed malicious `sourceMappingURL` comments in CSS files to trick PostCSS into loading arbitrary `.map` files from the filesystem. The fix upgrades PostCSS from 8.5.15 to 8.5.18 in `frontend/package-lock.json` and pins the version via an override in `frontend/package.json`, closing the file disclosure vector before it could be chained with other weaknesses.
A path traversal vulnerability in PostCSS versions prior to 8.5.x allowed attackers to craft malicious CSS with attacker-controlled `sourceMappingURL` comments, causing PostCSS to read arbitrary `.map` files from the filesystem and potentially disclose sensitive information. The fix upgrades PostCSS from `8.4.47` to `8.5.23` in `packages/devtools/package-lock.json`, closing the auto-loading attack surface entirely. This change is scoped to the devtools build toolchain but is critical for any env