CVE-2026-73646

A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted sourceMappingURL values in untrusted CSS files. This allows the attacker to disclose sensitive sourcesContent from arbitrary .map files accessible on the system, leading to information disclosure.

Important severity is assigned to this flaw because an unauthenticated remote attacker could read arbitrary source map files from the host filesystem without privileges if an application processes untrusted stylesheets. Within Red Hat products, PostCSS is bundled primarily inside web console frontends, build-time pipelines, and developer environments. Practical exposure is limited because most deployments only parse internal, developer-authored styles rather than accepting arbitrary user-supplied style sheets. Furthermore, environments that do not process untrusted external styling or that run purely as static client assets are not exposed to remote data disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.