CVE-2026-41305

MEDIUM

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

Title source: cna
STIX 2.1

Description

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.

References (2)

Core 2
Core References
X_Refsource_Misc x_refsource_misc
https://github.com/postcss/postcss/releases/tag/8.5.10

Scores

CVSS v3 6.1
EPSS 0.0019
EPSS Percentile 9.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
npm/postcss 0 - 8.5.10npm
postcss/postcss < 8.5.10
Published Apr 24, 2026
Tracked Since Apr 24, 2026