Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-qx2v-qp2m-jg93

Опубликовано: 24 апр. 2026
Источник: github
Github: Прошло ревью
CVSS3: 6.1

Описание

PostCSS has XSS via Unescaped in its CSS Stringify Output

PostCSS: XSS via Unescaped </style> in CSS Stringify Output

Summary

PostCSS v8.5.5 (latest) does not escape </style> sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML <style> tags, </style> in CSS values breaks out of the style context, enabling XSS.

Proof of Concept

const postcss = require('postcss'); // Parse user CSS and re-stringify for page embedding const userCSS = 'body { content: "</style><script>alert(1)</script><style>"; }'; const ast = postcss.parse(userCSS); const output = ast.toResult().css; const html = `<style>${output}</style>`; console.log(html); // <style>body { content: "</style><script>alert(1)</script><style>"; }</style> // // Browser: </style> closes the style tag, <script> executes

Tested output (Node.js v22, postcss v8.5.5):

Input: body { content: "</style><script>alert(1)</script><style>"; } Output: body { content: "</style><script>alert(1)</script><style>"; } Contains </style>: true

Impact

Impact non-bundler use cases since bundlers for XSS on their own. Requires some PostCSS plugin to have malware code, which can inject XSS to website.

Suggested Fix

Escape </style in all stringified output values:

output = output.replace(/<\/(style)/gi, '<\\/$1');

Credits

Discovered and reported by Sunil Kumar (@TharVid)

Ссылки

Пакеты

Наименование

postcss

npm
Затронутые версииВерсия исправления

< 8.5.10

8.5.10

EPSS

Процентиль: 11%
0.00205
Низкий

6.1 Medium

CVSS3

CVE ID

CVE-2026-41305

Дефекты

CWE-79

Связанные уязвимости

ubuntu логотип

CVE-2026-41305

CVSS3: 6.1
ubuntu
3 месяца назад

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.

redhat логотип

CVE-2026-41305

CVSS3: 6.1
redhat
3 месяца назад

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.

nvd логотип

CVE-2026-41305

CVSS3: 6.1
nvd
3 месяца назад

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.

msrc логотип

CVE-2026-41305

msrc
3 месяца назад

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

debian логотип

CVE-2026-41305

CVSS3: 6.1
debian
3 месяца назад

PostCSS takes a CSS file and provides an API to analyze and modify its ...

EPSS

Процентиль: 11%
0.00205
Низкий

6.1 Medium

CVSS3

CVE ID

CVE-2026-41305

Дефекты

CWE-79