Cross-site scripting in Postcss - CVE-2026-41305

Vulnerability identifier: #VU127462

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2026-41305

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary script in a victim's browser.

The vulnerability exists due to cross-site scripting in CSS stringify output when embedding re-stringified user-supplied CSS in HTML style tags. A remote attacker can supply crafted CSS containing an unescaped closing style sequence to execute arbitrary script in a victim's browser.

User interaction is required to load the generated HTML.

Postcss
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Maximo Application Suite - Manage Component
IBM Decision Optimization for Cloud Pak for Data
IBM Maximo Scheduler Optimization
Maximo Application Suite - Visual Inspection Component

Install security update from vendor's website.

Postcss - update to 8.5.10
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.26, 9.1.18
IBM Maximo Scheduler Optimization - addressed in versions 9.0.25, 9.1.14, 9.2.1
Maximo Application Suite - Visual Inspection Component - addressed in versions 9.0.20, 9.1.17
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6

• https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93
• https://github.com/advisories/GHSA-qx2v-qp2m-jg93

• Cross-site scripting in Postcss
• IBM Watson Discovery Cartridge update for PostCSS
• IBM Maximo Application Suite - Manage Component update for PostCSS
• IBM Maximo Application Suite - Visual Inspection Component update for PostCSS
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• IBM Maximo Scheduler Optimization update for PostCSS