Skip to content

Bump postcss@~8.5.10 to address CVE GHSA-qx2v-qp2m-jg93#5796

Merged
iclanton merged 1 commit intomicrosoft:mainfrom
cmalonzo:postcss/8.5.10
Apr 29, 2026
Merged

Bump postcss@~8.5.10 to address CVE GHSA-qx2v-qp2m-jg93#5796
iclanton merged 1 commit intomicrosoft:mainfrom
cmalonzo:postcss/8.5.10

Conversation

@cmalonzo
Copy link
Copy Markdown
Contributor

Summary

Addresses CVE: GHSA-qx2v-qp2m-jg93

PostCSS v8.5.5 (latest) does not escape </style> sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML <style> tags, </style> in CSS values breaks out of the style context, enabling XSS.

Details

How it was tested

  1. rush update
  2. rush build
  3. rush test

Impacted documentation

@iclanton iclanton merged commit 25b712d into microsoft:main Apr 29, 2026
6 checks passed
@github-project-automation github-project-automation Bot moved this from Needs triage to Closed in Bug Triage Apr 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Closed

Development

Successfully merging this pull request may close these issues.

2 participants