postcss

Tool for transforming styles with JS plugins

Latest 8.5.29

NPM

94%

Total Score

healthy

Healthy: actively maintained, transparently released, and backed by a non-archived project.

Are you affected? Scan for Free

Health Score Breakdown

Repo tooling

The project uses build tooling, but no security-scanning tool was reported. This is a modest hygiene gap rather than evidence of abandonment because a security policy is present.

Vulnerabilities

Title	Versions	Severity
CVE-2026-69153 postcss is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 8.5.22.	0.0.0 - 8.5.22	Medium
CVE-2026-73646 postcss is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 8.5.17.	0.0.0 - 8.5.17	High
CVE-2026-45623 postcss is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 8.5.11.	0.0.0 - 8.5.11	High
CVE-2026-41305 postcss is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 8.5.10.	0.0.0 - 8.5.10	Medium
CVE-2023-44270 postcss is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in versions 0.0.0 - 8.4.31.	0.0.0 - 8.4.31	Medium