Live › vulnerability › CVE-2026-61847
Crass is a Ruby CSS parser that, by default, discards comments by recursing once per comment. A crafted stylesheet with a very large number of adjacent comments can exhaust the stack and raise a SystemStackError, crashing the process handling it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:39 UTC. All times on this page are UTC.
Applications that parse attacker-supplied CSS with Crass while the default comment handling is in place are exposed; the failure is a crash rather than code execution. Systems that only process trusted stylesheets, or that set :preserve_comments to true, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| crass | rubygems | < 1.0.7 | 1.0.7 |
gem list crass or bundle exec gem list crass, or read the crass line in Gemfile.lock.:preserve_commentscrass 1.0.7 (affected versions are below 1.0.7).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When the :preserve_comments option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError.
This is fixed in Crass 1.0.7, which no longer recurses when discarding comments.
Set the :preserve_comments option to true if this is acceptable to your use case (recursion doesn't occur when comments are preserved).
This page as .md · .json · in your agent: get_signal("CVE-2026-61847")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.