Bug 2527461

Summary: CVE-2026-69153 frama-c: PostCSS: Information disclosure via crafted sourceMappingURL [fedora-all]
Product: [Fedora] Fedora Reporter: Matteo Signorini <msignori>
Component: frama-cAssignee: Jerry James <loganjerry>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: Andre.MARONEZE, loganjerry
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["a6e059a1-4502-48d3-a8db-757373eced47"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-09-02 15:46:27 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2510719    

Description Matteo Signorini 2026-09-02 14:05:56 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.
Comment 1 Jerry James 2026-09-02 15:46:27 UTC 
The JavaScript code in the frama-c package is for the ivette GUI. We do not build it or ship it in Fedora, so vulnerabilities in the JavaScript code are irrelevant. Please stop scanning the frama-c package for JavaScript vulnerabilities.