Ruby CSS Parser Vulnerability in Crass by R. Grove

CVE-2026-116695

What is CVE-2026-116695?

Crass, a Ruby CSS parser compliant with CSS Syntax Level 3, has a vulnerability that arises when it improperly treats a closing parenthesis after an escaped backslash during the processing of a malformed URL. This flaw can lead to the retention of declarations and style rules within a bad URL token, causing CSS-based attacks and potential exposure of sensitive information. Notably, this issue does not permit script execution in modern browsers, but a vulnerable implementation could permit unauthorized resource loading or UI redirection. Users are encouraged to upgrade to version 1.0.8 where this vulnerability has been addressed.

References