What is CVE-2026-45623?

CVE-2026-45623 is a high-severity vulnerability in Postcss, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-07-27.

How severe is CVE-2026-45623?

High severity. CVSS v3 base score is 7.5 out of 10.

Path Traversal in Postcss

CVE-2026-45623

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS…

Vulnerability class: Path Traversal (Directory Traversal)

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Postcss — versions < 8.5.12

Weakness classification (CWE)

CWE-22 — Path Traversal
CWE-200 — Information Disclosure

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-45623?: CVE-2026-45623 is a high-severity vulnerability in Postcss, classified under Path Traversal. CVSS score: 7.5/10. Published 2026-07-27.
How severe is CVE-2026-45623?: High severity. CVSS v3 base score is 7.5 out of 10.