Is CVE-2026-9358 actively exploited?

No active exploitation of CVE-2026-9358 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-9358 be exploited remotely?

Yes. CVE-2026-9358 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-9358?

CVE-2026-9358 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-9358

MEDIUM

CVE-2026-9358

CWE-404Published: May 24, 2026· Updated: May 26, 2026

4.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:10.0th

Official Description

A vulnerability was determined in postcss up to 7.1.1. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains, that according to his definition "DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS)."

NVD Source

Technical Analysis

CVE-2026-9358 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.