GHSA-pq4g-8rxf-4g29
UnknownSummary
Crass's tokenizer did not terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked.
Risk Assessment
This could allow bypassing CSS sanitization and injecting malicious content into the re-emitted stylesheet. Applications using Crass to sanitize untrusted CSS are at risk.
Recommendation
Upgrade the Crass library to a version containing the tokenizer fix for bad URLs with an escaped backslash. Until then, avoid relying solely on Crass for sanitizing untrusted CSS.
Other vulnerabilities in Crass
See all- GHSA-6jxj-px6v-747wUnknown
Crass recursively parses CSS simple blocks and functions without a depth guard, allowing an attacker to cause stack overflow or excessive memory usage via deeply nested blocks.
- GHSA-6wmf-3r64-vcwvUnknown
The vulnerability in the Crass library causes unbounded processing of scientific notation in CSS values before clamping the result to Float::MAX. An attacker can send a small crafted CSS string that forces excessive CPU and memory consumption.
- GHSA-8vfg-2r28-hvhjUnknown
A vulnerability in the Crass library causes excessive CPU consumption when parsing input containing non-ASCII characters. Inefficient tracking of multi-byte character positions leads to superlinear parsing time.
- GHSA-wwpr-jff3-395cUnknown
A vulnerability in the Crass library allows a DoS attack by providing a stylesheet with a very large number of adjacent CSS comments when the :preserve_comments option is disabled (default behavior). This causes excessive recursion and potential system resource exhaustion.
- CVE-2026-61845High
A vulnerability in the Crass library involves unbounded exponentiation when converting CSS scientific notation number values before clamping the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to consume excessive CPU and memory when processing a tiny input.
Original NVD description (English source)
## Summary Crass's tokenizer didn't terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into pas
Vulnerability data from NVD (NIST) · CISA KEV · EPSS