CVE-2026-41305 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
PostCSS fails to escape closing style tags, allowing attackers to inject scripts when user CSS is embedded in HTML.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-41305?
CVE-2026-41305 is a medium-severity cross-site scripting vulnerability in postcss, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.
Weakness: CWE-79
Which versions are affected by CVE-2026-41305?
2 open source packages ship an affected version, including postcss.
| Package | Affected | Fixed in |
|---|---|---|
postcss npm | All versions | 8.5.10 |
postcss npm | All versions | 8.5.10 |
How do I fix CVE-2026-41305?
Upgrade postcss to 8.5.10 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-41305 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41305 exists.
Sources
Also known as CLEANSTART-2026-DB71224, CLSA-2026-1779065184, CLSA-2026-1779065191, CLSA-2026-1779065192, CLSA-2026-1783991047, CLSA-2026-1783991051 and 25 more.