https://vulnerability.circl.lu/sightings/feed 2026-08-04T23:33:32.016771+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/885ff785-6e03-4d51-838c-0bf9b7d9e23d/export 2026-08-04T23:33:32.043318+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "885ff785-6e03-4d51-838c-0bf9b7d9e23d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-69153", "type": "published-proof-of-concept", "source": "https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp", "content": "", "creation_timestamp": "2026-08-03T18:35:03.587873Z"} 2026-08-03T18:35:03.587873+00:00 https://vulnerability.circl.lu/sighting/f73d90ae-d394-4298-b37a-9fd843e2d745/export 2026-08-04T23:33:32.045667+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "f73d90ae-d394-4298-b37a-9fd843e2d745", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69153", "type": "seen", "source": "https://gist.github.com/alon710/cea21195fa5b2fd7a130b5ccd15ff053", "content": "# CVE-2026-69153: CVE-2026-69153: Arbitrary File Read via Path Traversal in PostCSS\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69153\n\n## Summary\nA directory traversal and arbitrary file read vulnerability exists in PostCSS due to an incomplete fix of CVE-2026-45623. When parsing a CSS file containing a sourceMappingURL comment with the 'from' parameter unset, path traversal and absolute path validations are bypassed, enabling attackers to read arbitrary local .map files.\n\n## TL;DR\nPostCSS fails to validate sourceMappingURL paths when the 'from' option is omitted, allowing unauthenticated attackers to read arbitrary local .map files.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS v4.0**: 6.3\n- **Impact**: Confidentiality (Partial File Disclosure)\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications running server-side PostCSS compilation libraries without configuring the 'from' parameter.\n- **postcss**: < 8.5.19 (Fixed in: `8.5.19`)\n- **postcss**: >= 8.5.20 < 8.5.23 (Fixed in: `8.5.23`)\n\n## Mitigation\n\n- Upgrade PostCSS to version 8.5.19, 8.5.23 or newer.\n- Always set the 'from' option in options when running PostCSS on untrusted input.\n- WAF rules to filter or sanitize CSS files containing directory traversal indicators in sourceMappingURL.\n\n**Remediation Steps:**\n1. Run 'npm install postcss@latest' to update the dependency to the secure version.\n2. Inspect source code for usages of postcss().process() or postcss.parse().\n3. Verify that the 'from' option is configured with a valid path prefix on all input CSS parsing pipelines.\n\n## References\n\n- [NVD - CVE-2026-69153](https://nvd.nist.gov/vuln/detail/CVE-2026-69153)\n- [GitHub Security Advisory GHSA-fxqj-rqcc-2cmp](https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp)\n- [PostCSS 8.5.19 Release Notes](https://github.com/postcss/postcss/releases/tag/8.5.19)\n- [CVE.org - CVE-2026-69153](https://www.cve.org/CVERecord?id=CVE-2026-69153)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69153) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T18:31:17.253645Z"} 2026-08-03T18:31:17.253645+00:00 https://vulnerability.circl.lu/sighting/a4013369-4e50-4079-b2a9-aacd084c2dfa/export 2026-08-04T23:33:32.047360+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "a4013369-4e50-4079-b2a9-aacd084c2dfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69153", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/gp5oyt6frvyqh", "content": "CVE-2026-69153 - PostCSS: incomplete fix of CVE-2026-45623 \u2014 attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset\nCVE ID : CVE-2026-69153\n \n Published : Aug. 3, 2026, 5:16 p.m. | 41\u00a0minutes ago\n \n Description : PostCSS takes a CSS file and provi...", "creation_timestamp": "2026-08-03T18:28:13.250893Z"} 2026-08-03T18:28:13.250893+00:00