{"id":"CVE-2026-61847","kind":"vulnerability","aliases":["CVE-2026-61847","GHSA-wwpr-jff3-395c"],"related":[],"title":"Crass: A large number of adjacent CSS comments can trigger a SystemStackError","description":"### Impact\n\nWhen the `:preserve_comments` option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a `SystemStackError`.\n\n### Patches\n\nThis is fixed in Crass 1.0.7, which no longer recurses when discarding comments.\n\n### Workarounds\n\nSet the `:preserve_comments` option to `true` if this is acceptable to your use case (recursion doesn't occur when comments are preserved).","summary":"Crass is a Ruby CSS parser that, by default, discards comments by recursing once per comment. A crafted stylesheet with a very large number of adjacent comments can exhaust the stack and raise a SystemStackError, crashing the process handling it.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"crass","fixed":["1.0.7"],"affected":"< 1.0.7","ecosystem":"rubygems"}],"ecosystems":["rubygems"],"tags":["crass","css-parsing","cwe-674","package","ruby","rubygems"],"not_affected_if":["preserve-comments-enabled","trusted-input-only"],"how_to_check":"- Check the installed version with `gem list crass` or `bundle exec gem list crass`, or read the `crass` line in `Gemfile.lock`.\n- Look for any code path that passes untrusted CSS to Crass, such as user-supplied stylesheets or sanitizers, and whether `:preserve_comments` is set.","fix":"- `crass` `1.0.7` (affected versions are below `1.0.7`).","status":"open","published_at":"2026-10-29T16:35:23+00:00","first_seen_at":"2026-10-29T16:39:02+00:00","triaged_at":"2026-10-29T16:39:50+00:00","updated_at":"2026-10-29T16:39:50+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T16:39:50Z","model":"claude-haiku-5-5","output":{"fix":"- `crass` `1.0.7` (affected versions are below `1.0.7`).","reach":"unknown","title":"Crass: many adjacent CSS comments crash Ruby with stack overflow","impact":"low","summary":"Crass is a Ruby CSS parser that, by default, discards comments by recursing once per comment. A crafted stylesheet with a very large number of adjacent comments can exhaust the stack and raise a SystemStackError, crashing the process handling it.","audience":"developers","category":"package","nicknames":[],"who_cares":["ruby","rubygems","crass","css-parsing"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Process crashes from stack exhaustion on crafted input","analyst_note":"","how_to_check":"- Check the installed version with `gem list crass` or `bundle exec gem list crass`, or read the `crass` line in `Gemfile.lock`.\n- Look for any code path that passes untrusted CSS to Crass, such as user-supplied stylesheets or sanitizers, and whether `:preserve_comments` is set.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-input-only","preserve-comments-enabled"],"who_is_affected":"Applications that parse attacker-supplied CSS with Crass while the default comment handling is in place are exposed; the failure is a crash rather than code execution. Systems that only process trusted stylesheets, or that set `:preserve_comments` to true, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000711,"input_tokens":4307,"output_tokens":560,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,22A '-61847':15A,23A '-674':30B '1.0.7':125C '395c':20A 'accept':144C 'adjac':6A,59B,109C 'attack':98C 'behavior':86C 'case':148C 'caus':112C 'comment':8A,44B,49B,60B,77C,90C,110C,132C,137C,154C 'consum':93C 'contain':103C 'craft':51B 'crash':69B 'crass':1A,24A,25B,34B,87C,124C 'css':7A,27B,38B,89C 'css-pars':26B 'cve':13A,21A 'cwe':29B 'default':42B,85C 'discard':43B,88C,131C 'doesn':150C 'enabl':81C 'excess':113C 'exhaust':62B 'fix':122C 'ghsa':17A 'ghsa-wwpr-jff3-395c':16A 'handl':72B 'impact':73C 'jff3':19A 'larg':3A,56B,106C 'longer':128C 'next':95C 'number':4A,57B,107C 'occur':152C 'option':78C,138C 'packag':31B 'pars':28B 'parser':39B 'patch':119C 'per':48B 'preserv':76C,136C,156C 'process':71B 'provid':100C 'rais':66B 'recurs':46B,92C,114C,129C,149C 'rubi':32B,37B 'rubygem':33B 'set':134C 'stack':64B 'stylesheet':52B,102C 'systemstackerror':12A,68B,118C 'token':96C 'trigger':10A,116C 'true':140C 'use':147C 'workaround':133C 'wwpr':18A","nicknames":[],"mitigations":[],"who_affected":"Applications that parse attacker-supplied CSS with Crass while the default comment handling is in place are exposed; the failure is a crash rather than code execution. Systems that only process trusted stylesheets, or that set `:preserve_comments` to true, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T16:35:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-wwpr-jff3-395c","url":"https://github.com/advisories/GHSA-wwpr-jff3-395c","severity":"medium","published_at":"2026-10-29T16:35:23+00:00","modified_at":"2026-10-29T16:35:23+00:00","first_seen_at":"2026-10-29T16:39:02+00:00","fetched_at":"2026-10-29T16:39:02+00:00","note":null}],"documents":[{"id":17822,"url":"https://api.github.com/repos/rgrove/crass/security-advisories/GHSA-wwpr-jff3-395c","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":17823,"url":"https://github.com/rgrove/crass/security/advisories/GHSA-wwpr-jff3-395c","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":17824,"url":"https://github.com/rgrove/crass/commit/25d78cc607c54262e9d43ea1930f3ba5bb03dfb5","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":17821,"url":"https://github.com/rgrove/crass/releases/tag/v1.0.7","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}