GHSA-84w7-hpvm-rxx2
UnknownSummary
expand_shorthand! (and the expand_dimensions_shorthand! it calls) runs the RE_FUNCTIONS regex over declaration values. That regex has a nested quantifier inside a group that can recurse, so on a value that opens a CSS function and never closes it, the match degrades into exponential backtracking.
Risk Assessment
An attacker can supply specially crafted CSS, causing CPU resource exhaustion (DoS attack) and unavailability of the CSS-processing service. This can paralyze the application or server.
Recommendation
Update the library to a version that fixes the regex or limits recursion. Implement timeouts for CSS processing and input validation to prevent DoS attacks.
Other vulnerabilities in css_parser
See all- GHSA-w3mx-4vv9-hjpgMedium
When css_parser parses CSS containing an @import rule and the caller has supplied a :base_dir option (but not a :base_uri), the attacker-controlled import path is passed directly into load_file!, which does File.expand_path(file_name, base_dir) followed by File.read with no path containment.
- CVE-2026-53727High
SSRF vulnerability in the Ruby css_parser library versions 2.2.0 through 3.0.0. The read_remote_file method makes HTTP/HTTPS requests to any host without filtering, and redirects can lead to local file disclosure via file:// URIs.
Original NVD description (English source)
## SUMMARY expand_shorthand! (and the expand_dimensions_shorthand! it calls) runs the RE_FUNCTIONS regex over declaration values. That regex has a nested quantifier inside a group that can recurse, so on a value that opens a CSS function and never closes it, the match degrades into exponential back
Vulnerability data from NVD (NIST) · CISA KEV · EPSS