@@ -1,9 +1,19 @@
 'use strict'
 
-let { existsSync, readFileSync } = require('fs')
+let { existsSync, readFileSync, realpathSync } = require('fs')
 let { dirname, isAbsolute, join, relative, sep } = require('path')
 let { SourceMapConsumer, SourceMapGenerator } = require('source-map-js')
 
+function realPath(path) {
+  try {
+    return realpathSync(path)
+  } catch {
+    // Missing or dangling: keep the literal path. The existsSync() check below
+    // still gates the read, and a path that does not exist cannot escape.
+    return path
+  }
+}
+
 function fromBase64(str) {
   if (Buffer) {
     return Buffer.from(str, 'base64').toString()
@@ -89,7 +99,9 @@ class PreviousMap {
       if (!/\.map$/i.test(path)) return undefined
       if (!cssFile) return undefined
 
-      let rel = relative(dirname(cssFile), path)
+      // Compare *resolved* paths: relative() is textual, so without this a
+      // symlink at or below the CSS file's directory points the map outside it.
+      let rel = relative(realPath(dirname(cssFile)), realPath(path))
       if (rel === '..' || rel.startsWith('..' + sep) || isAbsolute(rel)) {
         return undefined
       }