css_parser vulnerabilities

When css_parser parses CSS containing an @import rule and the caller has supplied a :base_dir option (but not a :base_uri), the attacker-controlled import path is passed directly into load_file!, which does File.expand_path(file_name, base_dir) followed by File.read with no path containment.

expand_shorthand! (and the expand_dimensions_shorthand! it calls) runs the RE_FUNCTIONS regex over declaration values. That regex has a nested quantifier inside a group that can recurse, so on a value that opens a CSS function and never closes it, the match degrades into exponential backtracking.

SSRF vulnerability in the Ruby css_parser library versions 2.2.0 through 3.0.0. The read_remote_file method makes HTTP/HTTPS requests to any host without filtering, and redirects can lead to local file disclosure via file:// URIs.