diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index aa7b7ef68..04fb6b3a8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,7 +36,7 @@ jobs:
echo "EOF" >> $GITHUB_OUTPUT
- name: Create the release
if: steps.changelog.outputs.changelog_content != ''
- uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+ uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
with:
name: ${{ github.ref_name }}
body: '${{ steps.changelog.outputs.changelog_content }}'
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a7abcd6f8..aee09ae08 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
This project adheres to [Semantic Versioning](https://semver.org/).
+## 8.5.10
+
+- Fixed XSS via unescaped `` in non-bundler cases (by @TharVid).
+
## 8.5.9
- Speed up source map encoding paring in case of the error.
diff --git a/lib/lazy-result.js b/lib/lazy-result.js
index 1ea52b87a..2ad67da97 100644
--- a/lib/lazy-result.js
+++ b/lib/lazy-result.js
@@ -378,6 +378,16 @@ class LazyResult {
if (opts.stringifier) str = opts.stringifier
if (str.stringify) str = str.stringify
+ let rootSource = this.result.root.source
+ if (opts.map === undefined && !(rootSource && rootSource.input && rootSource.input.map)) {
+ let result = ''
+ str(this.result.root, i => {
+ result += i
+ })
+ this.result.css = result
+ return this.result
+ }
+
let map = new MapGenerator(str, this.result.root, this.result.opts)
let data = map.generate()
this.result.css = data[0]
diff --git a/lib/processor.js b/lib/processor.js
index 2afe2ef0a..5eda6c410 100644
--- a/lib/processor.js
+++ b/lib/processor.js
@@ -7,7 +7,7 @@ let Root = require('./root')
class Processor {
constructor(plugins = []) {
- this.version = '8.5.9'
+ this.version = '8.5.10'
this.plugins = this.normalize(plugins)
}
diff --git a/lib/stringifier.js b/lib/stringifier.js
index e07ad12e7..012fa622d 100644
--- a/lib/stringifier.js
+++ b/lib/stringifier.js
@@ -1,5 +1,17 @@
'use strict'
+// Escapes sequences that could break out of an HTML {
+ let root = new Root()
+ root.append(new Rule({ selector: '' }))
+ root.append(new AtRule({ name: 'media', params: '