An open index of dependabot pull requests across open source projects.

postcss

Ecosystem:
npm
Package URL:
pkg:npm/postcss
Total PRs:
27,772 Dependabot PRs
Latest PR:
about 2 hours ago
Unique Repositories:
14,846 repositories
Unique Repos (30 days):
581 repositories
Security Advisories
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
GHSA-r28c-9q8g-f849 CVE-2026-73646 HIGH published 4 months ago • updated 14 days ago
## Vulnerability Details **File**: `lib/previous-map.js` **Line**: 87-98 (`loadFile`), 129-144 (`loadMap`) ### Root Cause PostCSS auto-detects a...
Regular Expression Denial of Service in postcss
GHSA-hwj9-h5mp-3pm3 CVE-2021-23368 MODERATE published over 5 years ago • updated about 7 hours ago
The npm package `postcss` from 7.0.0 and before versions 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during sou...
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
GHSA-fxqj-rqcc-2cmp CVE-2026-69153 MODERATE published 3 months ago • updated 14 days ago
## Summary The fix for GHSA-6g55-p6wh-862q added a guard in `lib/previous-map.js` `PreviousMap.loadFile()` that restricts an attacker-controlled `...
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
GHSA-qx2v-qp2m-jg93 CVE-2026-41305 MODERATE published 7 months ago • updated 5 days ago
# PostCSS: XSS via Unescaped `</style>` in CSS Stringify Output ## Summary PostCSS v8.5.5 (latest) does not escape `</style>` sequences when stri...
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
GHSA-6g55-p6wh-862q CVE-2026-45623 HIGH published 4 months ago • updated 14 days ago
## Summary PostCSS's `PreviousMap` parses the `/*# sourceMappingURL=PATH */` comment from any CSS string passed to `process()` and dereferences `P...
Recent PRs
Package Details
Name: postcss
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/postcss
JSON API: View JSON
Security Advisories

7

Active advisories
HIGH 2
MODERATE 5
View All npm Advisories
Package Information
Description:

Tool for transforming styles with JS plugins

Repository: https://github.com/postcss/postcss
Homepage: https://postcss.org/
Latest Release: 8.5.4
over 1 year ago
Dependent Repos: 3,705,251
Dependent Packages: 38,375
Downloads: 405,275,377
Ranking: Top 0.0034% by dependent repos Top 0.002% by downloads Top 0.0027% by dependent pkgs
PR Status
Open 13,776 (49.6%)
Merged 2,249 (8.1%)
Closed 9,999 (36.0%)
PR Types
Major 654 (2.4%)
Minor 4,321 (15.6%)
Patch 21,016 (75.7%)
Removal 16 (0.1%)