Live › vulnerability › CVE-2026-116695
Go to dashboardCrass, a Ruby CSS parser, mishandles a closing parenthesis after an escaped backslash inside a bad URL token, so it keeps declarations, rules or at-rules that browsers would treat as live CSS. A sanitizer that uses Crass to reserialize untrusted CSS can let through UI redress, external resource loading or CSS-based data exfiltration, though script execution is not possible in modern browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 21:29 UTC. All times on this page are UTC.
Applications that use Crass to parse untrusted CSS and then reserialize it in a sanitizer, such as user-supplied styles in email or HTML rendering, are exposed. Applications that never parse untrusted CSS with Crass, or that only parse trusted stylesheets, are unlikely to be affected.
No product ranges from the sources yet.
bundle exec gem list crass or by reading Gemfile.lock for crass.Crass and Crass.parse to find where untrusted CSS is sanitized and reserialized.1.0.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8.
This page as .md · .json · in your agent: get_signal("CVE-2026-116695")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.