← Scan another repo

github.com/tailwindlabs/tailwindcss

@ 50daebded0a7

Submitted 8/4/2026, 10:25:54 AM · Status: ok

Risk grade
F
100 / 100
Findings
192
0 critical18 high33 medium3 low138 info0 on CISA KEV0ATT&CK
Showing 192 of 192 findings

Findings

  • fast-uri vulnerable to host confusion via failed IDN canonicalization
    grypeCVE-2026-13676EPSS 0.4%
  • fast-uri vulnerable to host confusion via literal backslash authority delimiter
    grypeCVE-2026-16221EPSS 0.2%
  • Next.js: Denial of Service in App Router using Server Actions
    grypeCVE-2026-64641EPSS 0.5%
  • Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
    grypeCVE-2026-64642EPSS 1.3%
  • Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
    grypeCVE-2026-64645EPSS 1.0%
  • Next.js: Server-Side Request Forgery in Server Actions on custom servers
    grypeCVE-2026-64649EPSS 0.6%
  • PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
    grypeCVE-2026-45623EPSS 0.5%
  • PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
    grype
  • PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
    grype
  • sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
    grype
  • Shell command built with interpolated input via child_process.exec — command injection risk. Use execFile with an argv array. (First-party socbox; Apache-2.0.)
    Shell command built with interpolated input via child_process.exec — command injection risk. Use execFile with an argv array. (First-party socbox; Apache-2.0.)
    semgrepscripts/pack-packages.mjs:41
  • next: Next.js: Authentication bypass leading to unauthorized access
    Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authenticat…
    trivyCVE-2026-64642
  • next: Next.js: Denial of Service via crafted requests to App Router with Server Actions
    Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processi…
    trivyCVE-2026-64641
  • next: Next.js: Server-Side Request Forgery via malicious host redirection in Server Actions
    Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-S…
    trivyCVE-2026-64649
  • next: Next.js: Server-Side Request Forgery vulnerability
    Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostn…
    trivyCVE-2026-64645
  • PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
    ## Vulnerability Details **File**: `lib/previous-map.js` **Line**: 87-98 (`loadFile`), 129-144 (`loadMap`) ### Root Cause PostCSS auto-detects a `/*# sourceMappingURL=... */` comment inside the CSS text it is asked to parse and, unless the caller explicitly passes `map: false`…
    trivy
  • postcss: PostCSS: Information disclosure and denial of service via crafted CSS input
    PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferen…
    trivyCVE-2026-45623
  • sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
    ### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with versions of sharp prior to 0.35.0 are affected. ### Patches #### Using prebuilt binaries…
    trivy

This report is public.