CLEANSTART-2026-FJ41942: PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it

Q: What does the available severity data indicate about impact?

The reported vector indicates an availability impact, with no reported confidentiality or integrity impact. The severity is rated medium at 5.9.

Q: What would an attacker need to exploit this issue?

The reported vector indicates network access is required, while no privileges or user interaction are required. Exploitation is rated high complexity.

Published Nov 5, 2026

Updated

Security vulnerability affects the npm package. PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it.

Affected Software

1 affected componentFixes available

cleanstart/npm<10.9.2-r1

10.9.2-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/npm to a version that resolves this vulnerability.
Fixed in 10.9.2-r1

Event History

Nov 5, 2026

Advisory Published

via OSV·06:32 AM

Data Sourced

via OSV·06:32 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-104844

Frequently Asked Questions

What does the available severity data indicate about impact?

The reported vector indicates an availability impact, with no reported confidentiality or integrity impact. The severity is rated medium at 5.9.

What would an attacker need to exploit this issue?

The reported vector indicates network access is required, while no privileges or user interaction are required. Exploitation is rated high complexity.

CLEANSTART-2026-FJ41942: PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does the available severity data indicate about impact?

What would an attacker need to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

What does the available severity data indicate about impact?

What would an attacker need to exploit this issue?