CVE-2026-41305: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

April 24, 2026

PostCSS v8.5.5 (latest) does not escape </style> sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML <style> tags, </style> in CSS values breaks out of the style context, enabling XSS.

References

github.com/advisories/GHSA-qx2v-qp2m-jg93
github.com/postcss/postcss/releases/tag/8.5.10
github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93
nvd.nist.gov/vuln/detail/CVE-2026-41305

Code Behaviors & Features

Detect and mitigate CVE-2026-41305 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →