chore(deps): update dependency postcss to v8.5.10 [security] by renovate[bot] · Pull Request #195 · rx-ts/vue

renovate · 2026-05-30T02:01:14Z

This PR contains the following updates:

Package	Change	Age	Confidence
postcss (source)	`8.4.33` → `8.5.10`

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

CVE-2026-41305 / GHSA-qx2v-qp2m-jg93

More information

Details

PostCSS: XSS via Unescaped `</style>` in CSS Stringify Output

Summary

PostCSS v8.5.5 (latest) does not escape </style> sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML <style> tags, </style> in CSS values breaks out of the style context, enabling XSS.

Proof of Concept

const postcss = require('postcss');

// Parse user CSS and re-stringify for page embedding
const userCSS = 'body { content: "</style><script>alert(1)</script><style>"; }';
const ast = postcss.parse(userCSS);
const output = ast.toResult().css;
const html = `<style>${output}</style>`;

console.log(html);
// <style>body { content: "</style><script>alert(1)</script><style>"; }</style>
//
// Browser: </style> closes the style tag, <script> executes

Tested output (Node.js v22, postcss v8.5.5):

Input: body { content: "</style><script>alert(1)</script><style>"; }
Output: body { content: "</style><script>alert(1)</script><style>"; }
Contains </style>: true

Impact

Impact non-bundler use cases since bundlers for XSS on their own. Requires some PostCSS plugin to have malware code, which can inject XSS to website.

Suggested Fix

Escape </style in all stringified output values:

output = output.replace(/<\/(style)/gi, '<\\/$1');

Credits

Discovered and reported by Sunil Kumar (@TharVid)

Severity

CVSS Score: 6.1 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

postcss/postcss (postcss)

`v8.5.10`

Compare Source

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

`v8.5.9`

Compare Source

Speed up source map encoding paring in case of the error.

`v8.5.8`

Compare Source

Fixed Processor#version.

`v8.5.7`

Compare Source

Improved source map annotation cleaning performance (by CodeAnt AI).

`v8.5.6`

Compare Source

Fixed ContainerWithChildren type discriminating (by @Goodwine).

`v8.5.5`

Compare Source

Fixed package.json→exports compatibility with some tools (by @JounQin).

`v8.5.4`

Compare Source

Fixed Parcel compatibility issue (by @git-sumitchaudhary).

`v8.5.3`

Compare Source

Added more details to Unknown word error (by @hiepxanh).
Fixed types (by @romainmenke).
Fixed docs (by @catnipan).

`v8.5.2`

Compare Source

Fixed end position of rules with semicolon (by @romainmenke).

`v8.5.1`

Compare Source

Fixed declaration parsing performance (by @homanp).

`v8.5.0`: 8.5 “Duke Alloces”

Compare Source

PostCSS 8.5 brought API to work better with non-CSS sources like HTML, Vue.js/Svelte sources or CSS-in-JS.

@romainmenke during his work on Stylelint added Input#document in additional to Input#css.

root.source.input.document //=> "<p>Hello</p>
                           //    <style>
                           //    p {
                           //      color: green;
                           //    }
                           //    </style>"
root.source.input.css      //=> "p {
                           //      color: green;
                           //    }"

Thanks to Sponsors

This release was possible thanks to our community.

If your company wants to support the sustainability of front-end infrastructure or wants to give some love to PostCSS, you can join our supporters by:

Tidelift with a Spotify-like subscription model supporting all projects from your lock file.
Direct donations at GitHub Sponsors or Open Collective.

`v8.4.49`

Compare Source

Fixed custom syntax without source.offset (by @romainmenke).

`v8.4.48`

Compare Source

Fixed position calculation in error/warnings methods (by @romainmenke).

`v8.4.47`

Compare Source

Removed debug code.

`v8.4.46`

Compare Source

Fixed Cannot read properties of undefined (reading 'before').

`v8.4.45`

Compare Source

Removed unnecessary fix which could lead to infinite loop.

`v8.4.44`

Compare Source

Another way to fix markClean is not a function error.

`v8.4.43`

Compare Source

Fixed markClean is not a function error.

`v8.4.42`

Compare Source

Fixed CSS syntax error on long minified files (by @varpstar).

`v8.4.41`

Compare Source

Fixed types (by @nex3 and @querkmachine).
Cleaned up RegExps (by @bluwy).

`v8.4.40`

Compare Source

Moved to getter/setter in nodes types to help Sass team (by @nex3).

`v8.4.39`

Compare Source

Fixed CssSyntaxError types (by @romainmenke).

`v8.4.38`

Compare Source

Fixed endIndex: 0 in errors and warnings (by @romainmenke).

`v8.4.37`

Compare Source

Fixed original.column are not numbers error in another case.

`v8.4.36`

Compare Source

Fixed original.column are not numbers error on broken previous source map.

`v8.4.35`

Compare Source

Avoid ! in node.parent.nodes type.
Allow to pass undefined to node adding method to simplify types.

`v8.4.34`

Compare Source

Fixed AtRule#nodes type (by Tim Weißenfels).
Cleaned up code (by Dmitry Kirillov).

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

changeset-bot · 2026-05-30T02:01:19Z

⚠️ No Changeset found

Latest commit: 20994c2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-05-30T02:02:24Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	postcss@8.4.33 ⏵ 8.5.20	⁺¹	⁺²	^-1	⁺⁶

View full report

github-actions · 2026-05-30T02:02:37Z

📊 Package size report `No changes`

File	Before	After
Total _{(Includes all files)}	`93.2 kB`	`93.2 kB`
Tarball size	`18.6 kB`	`18.6 kB`

Unchanged files

File	Size
`.babelrc`	`114 B`
`.browserslistrc`	`41 B`
`.changeset/config.json`	`308 B`
`.changeset/README.md`	`510 B`
`.codesanbox/ci.json`	`76 B`
`.commitlintrc`	`35 B`
`.editorconfig`	`145 B`
`.eslintignore`	`95 B`
`.eslintrc`	`389 B`
`.github/workflows/ci.yml`	`723 B`
`.github/workflows/codeql.yml`	`852 B`
`.github/workflows/pkg-size.yml`	`474 B`
`.github/workflows/release.yml`	`1.1 kB`
`.lintstagedrc.cjs`	`54 B`
`.postcssrc.cjs`	`51 B`
`.prettierignore`	`16 B`
`.prettierrc`	`31 B`
`.remarkrc`	`42 B`
`.renovaterc`	`49 B`
`.simple-git-hooks.cjs`	`51 B`
`.stylelintignore`	`92 B`
`.stylelintrc`	`96 B`
`.vitepress/components/index.ts`	`191 B`
`.vitepress/components/VueQrcodeDemo.vue`	`5.7 kB`
`.vitepress/components/VueQriousDemo.vue`	`3.4 kB`
`.vitepress/components/VueResizorDemo.vue`	`658 B`
`.vitepress/config.ts`	`310 B`
`.vitepress/theme/index.ts`	`337 B`
`CHANGELOG.md`	`280 B`
`index.md`	`6.6 kB`
`LICENSE`	`1.1 kB`
`package.json`	`2.2 kB`
`packages/vue-qrcode/CHANGELOG.md`	`5.2 kB`
`packages/vue-qrcode/index.md`	`5.3 kB`
`packages/vue-qrcode/index.ts`	`3.3 kB`
`packages/vue-qrcode/package.json`	`1.0 kB`
`packages/vue-qrcode/README.md`	`5.5 kB`
`packages/vue-qrcode/tsconfig.json`	`139 B`
`packages/vue-qrious/CHANGELOG.md`	`4.6 kB`
`packages/vue-qrious/index.md`	`4.5 kB`
`packages/vue-qrious/index.ts`	`1.1 kB`
`packages/vue-qrious/package.json`	`1.1 kB`
`packages/vue-qrious/qrious.d.ts`	`472 B`
`packages/vue-qrious/README.md`	`4.5 kB`
`packages/vue-qrious/tsconfig.json`	`174 B`
`packages/vue-qrious/typings.d.ts`	`46 B`
`packages/vue-resizor/CHANGELOG.md`	`800 B`
`packages/vue-resizor/index.md`	`4.0 kB`
`packages/vue-resizor/package.json`	`1.2 kB`
`packages/vue-resizor/README.md`	`4.0 kB`
`packages/vue-resizor/src/bem.ts`	`635 B`
`packages/vue-resizor/src/helpers.ts`	`1.9 kB`
`packages/vue-resizor/src/index.ts`	`141 B`
`packages/vue-resizor/src/Resizor.tsx`	`8.8 kB`
`packages/vue-resizor/src/styles.less`	`691 B`
`packages/vue-resizor/src/types.ts`	`358 B`
`packages/vue-resizor/tsconfig.json`	`172 B`
`README.md`	`6.6 kB`
`tsconfig.base.json`	`362 B`
`tsconfig.json`	`343 B`
`vercel.json`	`124 B`

_{🤖 This report was automatically generated by pkg-size-action}

renovate Bot force-pushed the renovate/npm-postcss-vulnerability branch 2 times, most recently from 29df0fc to c14ec3b Compare July 16, 2026 16:56

chore(deps): update dependency postcss to v8.5.10 [security]

20994c2

renovate Bot force-pushed the renovate/npm-postcss-vulnerability branch from c14ec3b to 20994c2 Compare July 21, 2026 03:51

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): update dependency postcss to v8.5.10 [security]#195

chore(deps): update dependency postcss to v8.5.10 [security]#195
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-postcss-vulnerability

renovate Bot commented May 30, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented May 30, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented May 30, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

renovate Bot commented May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

Details

PostCSS: XSS via Unescaped </style> in CSS Stringify Output

Summary

Proof of Concept

Impact

Suggested Fix

Credits

Severity

References

Release Notes

v8.5.0: 8.5 “Duke Alloces”

Thanks to Sponsors

Configuration

Uh oh!

changeset-bot Bot commented May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

socket-security Bot commented May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 30, 2026

📊 Package size report No changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 30, 2026 •

edited

Loading

PostCSS: XSS via Unescaped `</style>` in CSS Stringify Output

`v8.5.0`: 8.5 “Duke Alloces”

changeset-bot Bot commented May 30, 2026 •

edited

Loading

socket-security Bot commented May 30, 2026 •

edited

Loading

📊 Package size report `No changes`