in its CSS Stringify Output","description":"PostCSS: XSS via Unescaped in CSS Stringify Output: Summary: PostCSS v8.5.5 (latest) does not escape sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML in CSS values breaks out of the style context, enabling XSS. Proof of Concept: const postcss = require('postcss'); // Parse user CSS and re-stringify for page embedding const userCSS = 'body { content: \"` in CSS Stringify Output\n\n## Summary\n\nPostCSS v8.5.5 (latest) does not escape `` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `` in CSS values breaks out of the style context, enabling XSS.\n\n## Proof of Concept\n\n```javascript\nconst postcss = require('postcss');\n\n// Parse user CSS and re-stringify for page embedding\nconst userCSS = 'body { content: \"