All vulnerabilities

npm

CVE-2026-41305

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

Severity: Medium 6.1
Published: 24 Apr 2026
Last changed: 10 Sept 2026
Added to UpHeron: 22 Oct 2026
Fixed in: 8.5.10
Also known as: GHSA-qx2v-qp2m-jg93
Sources: OSV.dev and GitHub

Affected software

Software	Affected versions
postcssnpm · `osv:npm:postcss`	Every version before 8.5.10

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-41305
GitHub Advisory Database https://github.com/advisories/GHSA-qx2v-qp2m-jg93