GHSA-qx2v-qp2m-jg93 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

• npm postcss: < 8.5.10 → fixed in 8.5.10

PostCSS: XSS via Unescaped `` in CSS Stringify Output Summary PostCSS v8.5.5 (latest) does not escape `` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `` tags, `` in CSS values breaks out of the style context, enabling XSS. Proof of Concept ```javascript const postcss = require('postcss'); // Parse user CSS and re-stringify for page embedding const userCSS = 'body { content: "alert(1)"; }'; const ast = postcss.parse(userCSS); const output = ast.toResult().css; const html = `${output}`; console.log(html); // body { content: "alert(1)"; } // // Browser: closes the style tag, executes ``` Tested output (Node.js v22, postcss v8.5.5): ``` Input: body { content: "alert(1)"; } Output: body { content: "alert(1)"; } Contains : true ``` Impact Impact non-bundler use cases since bundlers for XSS on their own. Requires some PostCSS plugin to have malware code, which can inject XSS to website. Suggested Fix Escape `</style` in all stringified output values: ```javascript output = output.replace(/<\/(style)/gi, '<\\/$1'); ``` Credits Discovered and reported by Sunil Kumar (@TharVid)