GHSA-w3mx-4vv9-hjpg
MediumSummary
When css_parser parses CSS containing an @import rule and the caller has supplied a :base_dir option (but not a :base_uri), the attacker-controlled import path is passed directly into load_file!, which does File.expand_path(file_name, base_dir) followed by File.read with no path containment.
Risk Assessment
An attacker can inject a malicious import path, potentially leading to arbitrary file read from the server's filesystem. This could result in leakage of sensitive data such as configuration files or keys.
Recommendation
Update css_parser to a version containing the fix or avoid using the :base_dir option without :base_uri. Consider validating and sanitizing import paths before passing them to the parser.
Other vulnerabilities in css_parser
See all- GHSA-84w7-hpvm-rxx2Unknown
expand_shorthand! (and the expand_dimensions_shorthand! it calls) runs the RE_FUNCTIONS regex over declaration values. That regex has a nested quantifier inside a group that can recurse, so on a value that opens a CSS function and never closes it, the match degrades into exponential backtracking.
- CVE-2026-53727High
SSRF vulnerability in the Ruby css_parser library versions 2.2.0 through 3.0.0. The read_remote_file method makes HTTP/HTTPS requests to any host without filtering, and redirects can lead to local file disclosure via file:// URIs.
Original NVD description (English source)
## Summary When css_parser parses CSS that contains an @import rule and the caller has supplied a :base_dir option (but not a :base_uri), the attacker-controlled import path is passed directly into load_file!, which does File.expand_path(file_name, base_dir) followed by File.read with no path conta
Vulnerability data from NVD (NIST) · CISA KEV · EPSS