https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:38:55 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/cleanstart-2026-bg21634 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: langfuse-worker</p> <p>Package langfuse-worker version 3.216.0-r1 fixes 29 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, ghsa-55q2-fjhq-7xh7, ghsa-c2j3-45gr-mqc4, CVE-2026-69192...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: langfuse-worker</p> <p>Package langfuse-worker version 3.216.0-r1 fixes 29 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, ghsa-55q2-fjhq-7xh7, ghsa-c2j3-45gr-mqc4, CVE-2026-69192...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-bg21634 https://cve.radiocsirt.org/vuln/euvd-2026-343847 EUVD-2026-343847 https://cve.radiocsirt.org/vuln/euvd-2026-343847 https://cve.radiocsirt.org/vuln/fkie_cve-2026-69153 <p>PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.</p> <p>PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-69153 https://cve.radiocsirt.org/vuln/ghsa-fxqj-rqcc-2cmp <p><strong>Affected:</strong> npm: postcss</p> <p>## Summary</p> <p>The fix for GHSA-6g55-p6wh-862q added a guard in `lib/previous-map.js` `PreviousMap.loadFile()` that restricts an attacker-controlled `sourceMappingURL` (from a CSS comment) to a `.map` extension and, for untrusted maps, rejects `..` traversal and absolute paths. The traversal/absolute rejection is nested inside `if (cssFile) { ... }`. When PostCSS is invoked without the `from` option, `cssFile` is falsy and that branch is skipped, leaving only the `.map` extension check.</p> <p>`PreviousMap` is constructed by `lib/input.js` whenever `pathAvailable &amp;&amp; sourceMapAvailable` (under Node with source-map available), independent of `opts.from`/`opts.map` (the constructor returns early only for `opts.map === false`). So `postcss([]).process(css)` on attacker CSS reaches `loadFile` with `cssFile` undefined, and an attacker `/*# sourceMappingURL=/abs/path/x.map */` (or `../`-traversing path) is read via `readFileSync`. When the file is valid JSON, its `sources` (filesystem paths) and `sourcesContent` (source contents) are disclosed in the generated source map.</p> <p>## Affected code (v8.5.22 — the release carrying the GHSA-6g55 fix)</p> <p>```js // lib/previous-map.js loadFile(path, cssFile, trusted) { if (!trusted &amp;&amp; !this.unsafeMap) { if (!/\.map$/i.test(path)) { return undefined } if (cssFile) { // guard runs ONLY when `from` is set let relativePath = relative(dirname(cssFile), path) if (relativePath === &#39;..&#39; || relativePat…</p> <p><strong>Affected:</strong> npm: postcss</p> <p>## Summary</p> <p>The fix for GHSA-6g55-p6wh-862q added a guard in `lib/previous-map.js` `PreviousMap.loadFile()` that restricts an attacker-controlled `sourceMappingURL` (from a CSS comment) to a `.map` extension and, for untrusted maps, rejects `..` traversal and absolute paths. The traversal/absolute rejection is nested inside `if (cssFile) { ... }`. When PostCSS is invoked without the `from` option, `cssFile` is falsy and that branch is skipped, leaving only the `.map` extension check.</p> <p>`PreviousMap` is constructed by `lib/input.js` whenever `pathAvailable &amp;&amp; sourceMapAvailable` (under Node with source-map available), independent of `opts.from`/`opts.map` (the constructor returns early only for `opts.map === false`). So `postcss([]).process(css)` on attacker CSS reaches `loadFile` with `cssFile` undefined, and an attacker `/*# sourceMappingURL=/abs/path/x.map */` (or `../`-traversing path) is read via `readFileSync`. When the file is valid JSON, its `sources` (filesystem paths) and `sourcesContent` (source contents) are disclosed in the generated source map.</p> <p>## Affected code (v8.5.22 — the release carrying the GHSA-6g55 fix)</p> <p>```js // lib/previous-map.js loadFile(path, cssFile, trusted) { if (!trusted &amp;&amp; !this.unsafeMap) { if (!/\.map$/i.test(path)) { return undefined } if (cssFile) { // guard runs ONLY when `from` is set let relativePath = relative(dirname(cssFile), path) if (relativePath === &#39;..&#39; || relativePat…</p> https://cve.radiocsirt.org/vuln/ghsa-fxqj-rqcc-2cmp https://cve.radiocsirt.org/vuln/msrc_cve-2026-69153 msrc_CVE-2026-69153 https://cve.radiocsirt.org/vuln/msrc_cve-2026-69153 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11680-1 <p>agama-web-ui-24+0.a836cced5-52.1 on GA media</p> <p>agama-web-ui-24+0.a836cced5-52.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11680-1 https://cve.radiocsirt.org/vuln/rhsa-2026:50070 <p>postcss: PostCSS: Information disclosure via crafted sourceMappingURL</p> <p>postcss: PostCSS: Information disclosure via crafted sourceMappingURL</p> https://cve.radiocsirt.org/vuln/rhsa-2026:50070 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-69153 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-postcss, Ubuntu:22.04:LTS: node-postcss, Ubuntu:24.04:LTS: node-postcss, Ubuntu:26.04:LTS: node-postcss</p> <p>PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-postcss, Ubuntu:22.04:LTS: node-postcss, Ubuntu:24.04:LTS: node-postcss, Ubuntu:26.04:LTS: node-postcss</p> <p>PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-69153