Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
GitHub Actions postcss could let attackers run code
published 3 months ago
Summary
The postcss component used in GitHub Actions had two security weaknesses that could allow an attacker to execute unwanted code. The software has been rebuilt and a new version (8.2.15‑tuxcare.1) is available that patches these issues. Apply the update as soon as possible to keep your workflows safe.
What to do
- Update GitHub Actions postcss to version 8.2.15-tuxcare.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:npm | GitHub Actions | postcss |
>= 8.2.15-tuxcare.0, < 8.2.15-tuxcare.1 Fix: upgrade to 8.2.15-tuxcare.1
|
Original advisory text
TuxCare security update for postcss (2 CVEs)
TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.2.15-tuxcare.1.
Timeline
Published4 Aug 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CLSA-2026-1779065188 · OSV
Track software like this
Free during beta