postcss

Tool for transforming styles with JS plugins

Latest 8.5.30

92%

Total Score

healthy

Long-running, actively maintained release with strong provenance and documentation; recent work is concentrated in one contributor.

Are you affected? Scan for Free

Health Score Breakdown

Repo bus factor

One contributor made about 87% of recent commits, although three other contributors were active; this creates a meaningful continuity concern.

Repo tooling

The project uses established build tooling, but no security-scanning tools were detected; the repository's security policy partly compensates for this hygiene gap.

Vulnerabilities

Title	Versions	Severity
CVE-2026-69153 postcss is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 8.5.22.	0.0.0 - 8.5.22	Medium
CVE-2026-73646 postcss is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 8.5.17.	0.0.0 - 8.5.17	High
CVE-2026-45623 postcss is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 8.5.11.	0.0.0 - 8.5.11	High
CVE-2026-41305 postcss is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 8.5.10.	0.0.0 - 8.5.10	Medium
CVE-2023-44270 postcss is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in versions 0.0.0 - 8.4.31.	0.0.0 - 8.4.31	Medium