CVE-2026-116695
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In the Crass Ruby CSS parser prior to 1.0.8, a closing parenthesis after an escaped backslash is incorrectly treated as escaped while consuming the remnants of a bad URL. Crass keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS.
Risk Assessment
A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow UI redress, external resource loading, or CSS-based data exfiltration. The issue does not enable script execution in modern browsers.
Recommendation
Upgrade Crass to version 1.0.8 or later. In CSS sanitizers, reject or normalize bad URL tokens instead of reserializing them.
Other vulnerabilities in Crass
See all- GHSA-6jxj-px6v-747wUnknown
Crass recursively parses CSS simple blocks and functions without a depth guard, allowing an attacker to cause stack overflow or excessive memory usage via deeply nested blocks.
- GHSA-6wmf-3r64-vcwvUnknown
The vulnerability in the Crass library causes unbounded processing of scientific notation in CSS values before clamping the result to Float::MAX. An attacker can send a small crafted CSS string that forces excessive CPU and memory consumption.
- GHSA-8vfg-2r28-hvhjUnknown
A vulnerability in the Crass library causes excessive CPU consumption when parsing input containing non-ASCII characters. Inefficient tracking of multi-byte character positions leads to superlinear parsing time.
- GHSA-wwpr-jff3-395cUnknown
A vulnerability in the Crass library allows a DoS attack by providing a stylesheet with a very large number of adjacent CSS comments when the :preserve_comments option is disabled (default behavior). This causes excessive recursion and potential system resource exhaustion.
- CVE-2026-61847Medium
When the :preserve_comments option is not enabled (the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker providing a stylesheet with a very large number of adjacent comments can cause excessive recursion.
- CVE-2026-61848Medium
When parsing input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. Attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumption.
- CVE-2026-61846Medium
Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises SystemStackError: stack level too deep, or cause excessive memory usage.
- GHSA-pq4g-8rxf-4g29Unknown
Crass's tokenizer did not terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked.
- CVE-2026-61845High
A vulnerability in the Crass library involves unbounded exponentiation when converting CSS scientific notation number values before clamping the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to consume excessive CPU and memory when processing a tiny input.
Original NVD description (English source)
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS