CVE-2026-53727
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
SSRF vulnerability in the Ruby css_parser library versions 2.2.0 through 3.0.0. The read_remote_file method makes HTTP/HTTPS requests to any host without filtering, and redirects can lead to local file disclosure via file:// URIs.
Risk Assessment
An attacker can use this vulnerability to scan internal networks, read sensitive files on the server, or attack other systems.
Recommendation
Update the css_parser library to version 3.0.0, which contains the fix.
Other vulnerabilities in css_parser
See all- GHSA-w3mx-4vv9-hjpgMedium
When css_parser parses CSS containing an @import rule and the caller has supplied a :base_dir option (but not a :base_uri), the attacker-controlled import path is passed directly into load_file!, which does File.expand_path(file_name, base_dir) followed by File.read with no path containment.
- GHSA-84w7-hpvm-rxx2Unknown
expand_shorthand! (and the expand_dimensions_shorthand! it calls) runs the RE_FUNCTIONS regex over declaration values. That regex has a nested quantifier inside a group that can recurse, so on a value that opens a CSS function and never closes it, the match degrades into exponential backtracking.
Original NVD description (English source)
css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_remote_file in lib/css_parser/parser.rb, and therefore load_uri! and the @import-following branch of add_block!, issued HTTP and HTTPS requests against any host, port, and URI without a scheme allowlist, host or IP filtering, or protection against link-local, loopback, or RFC-1918 addresses. Location: redirects were followed recursively back into the same function, which also serviced file:// URIs, so a single attacker-controlled HTTP redirect could upgrade the bug from SSRF to arbitrary local file disclosure. Any consumer of css_parser that hands it attacker-influenced CSS together with a base_uri: option is exposed. This issue is fixed in version 3.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS