Home › CVE Intelligence › CVE-2026-45623
CVSS 9.8 CRITICAL Security Vulnerability

CVE-2026-45623: PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMap…

Summary PostCSS's PreviousMap parses the /*sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An at…

9.8CVSS Score
CRITICALSeverity
NOCISA KEV
Security VulnerabilityImpact Type

📋 Vulnerability Details

CVE IDCVE-2026-45623
VendorUnknown Vendor
Affected ProductUnknown Product
Vulnerability TypeSecurity Vulnerability
CVSS Score9.8 (CRITICAL)
Actively Exploited❌ No known exploitation
Patch StatusPending Vendor Disclosure
Reported ByCYBERDUDEBIVASH SENTINEL APEX Intelligence (via sentinel_apex)

🔬 Technical Analysis

#

Summary

PostCSS's PreviousMap parses the /*

sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the... [Full analysis available on Pro]

⚡ DETECTION RULES AVAILABLE

Get CVE-2026-45623 Detection Pack

Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.

✓ Sigma Rules ✓ YARA Pack ✓ IOC Table ✓ SIEM Queries
🛡️ Get Detection Pack → 🔌 Access via API →

🔗 Related Intelligence