From PostCSS Masquerading to Windows RAT

CVE-2026-41305 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output