CVE-2026-69153

The CVSS 5.3 score for CVE-2026-69153 materially understates the risk. This is a directory traversal in PostCSS that exploits the sourceMappingURL directive to expose source map data when the `from` parameter is unset. While the CVSS treats this as a minor information disclosure, the actual exposure is the `sources` array (revealing internal paths, naming conventions, and server structures from your build process) and the `sourcesContent` array (containing original pre-minification source code with intact variable names and comments). This is structured intelligence about your internal architecture — far more valuable to an attacker than arbitrary file reads. The vulnerability triggers when PostCSS processes CSS with an injected sourceMappingURL comment pointing to an absolute path or path traversal sequence, and `from` is not set in the PostCSS options. In this configuration, PreviousMap.loadFile() resolves the source map path relative to the CSS file location rather than a secure root, allowing read access to files outside the intended scope. Check your PostCSS integrations immediately: ensure the `from` option is explicitly passed when processing any CSS, particularly in build pipelines, CMS plugins, documentation generators, or any system that processes third-party or user-submitted stylesheets. Update to PostCSS 8.5.19. If you use PostCSS through Webpack, Vite, or Next.js, verify those tools are passing `from` correctly in their PostCSS invocations — most do by default, but custom configurations may not. The deeper concern is the capability accumulation pattern. PostCSS is a CSS transformer that most developers never expect to read arbitrary files. It's embedded transitively in markdown renderers, documentation tools, CMS plugins, and build systems — layers of dependencies you may not control or even know are in your stack. The semantic gap between 'CSS parser' and 'arbitrary file reader via source map injection' is exactly the kind of hidden attack surface that escapes developer mental models and security reviews. Assume attackers are aware of this vector and scan for it in supply chain reconnaissance.

Reviewed through automated stages and approved by a human before publication.