High [CVE-2026-73646] Information disclosure via path traversal in source map auto-loading

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree.

Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute.map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable.map files through result.map.

This issue is fixed in version 8.5.18. A flaw was found in PostCSS.

An attacker can exploit a path traversal vulnerability by providing specially crafted `sourceMappingURL` values in untrusted CSS files. This allows the attacker to disclose sensitive `sourcesContent` from arbitrary `.map` files accessible on the system, leading to information disclosure.

Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-22.

Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Hardened Images; Red Hat Migration Toolkit 1.8; and 23 more.

Affected products named by the advisory: Red Hat OpenShift Dev Spaces 3.30; Red Hat Satellite 6.18; Red Hat Satellite 6.19; Red Hat Trusted Artifact Signer 1.3; and 19 more.