Vulnerable Library - autoprefixer-10.4.5.tgz
Path to dependency file: /dgrv4_Gateway_serv/srcAngular/package.json
Path to vulnerable library: /dgrv4_Gateway_serv/srcAngular/package.json
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (autoprefixer version) |
Remediation Possible** |
| CVE-2026-41305 |
 Medium |
6.1 |
postcss-8.5.6.tgz |
Transitive |
10.4.6 |
❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-41305
Vulnerable Library - postcss-8.5.6.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz
Path to dependency file: /dgrv4_Gateway_serv/srcAngular/package.json
Path to vulnerable library: /dgrv4_Gateway_serv/srcAngular/package.json
Dependency Hierarchy:
- autoprefixer-10.4.5.tgz (Root Library)
- ❌ postcss-8.5.6.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape "</style>" sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML "<style>" tags, "</style>" in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.
Publish Date: 2026-04-24
URL: CVE-2026-41305
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-qx2v-qp2m-jg93
Release Date: 2026-04-24
Fix Resolution (postcss): 8.5.10
Direct dependency fix Resolution (autoprefixer): 10.4.6
Step up your Open Source Security Game with Mend here
Path to dependency file: /dgrv4_Gateway_serv/srcAngular/package.json
Path to vulnerable library: /dgrv4_Gateway_serv/srcAngular/package.json
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - postcss-8.5.6.tgz
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz
Path to dependency file: /dgrv4_Gateway_serv/srcAngular/package.json
Path to vulnerable library: /dgrv4_Gateway_serv/srcAngular/package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape "</style>" sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML "<style>" tags, "</style>" in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.
Publish Date: 2026-04-24
URL: CVE-2026-41305
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-qx2v-qp2m-jg93
Release Date: 2026-04-24
Fix Resolution (postcss): 8.5.10
Direct dependency fix Resolution (autoprefixer): 10.4.6
Step up your Open Source Security Game with Mend here