CVE-2026-116695 Details
Description
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8.
A vulnerability in the Crass Ruby library, specifically in versions prior to 1.0.8, allows for improper handling of bad URL tokens in CSS. The issue arises because the tokenizer fails to correctly terminate a bad URL when a closing parenthesis follows an escaped backslash, leading to Crass consuming more input than a compliant browser would. This mis-tokenization can be exploited by CSS sanitizers that use Crass to parse and reserialize CSS, potentially allowing the injection of arbitrary CSS declarations or rules that a browser would apply. While this vulnerability does not enable script execution in modern browsers, it could be used for UI redress or unauthorized data exfiltration via CSS.
Upgrade Crass to version 1.0.8 or later. Users of CSS sanitizers that incorporate Crass should also update to the latest version of Crass.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rgrove/crass/commit/689fc45c632fdf3803b2f4e844ffc9cca3b08f34 | [email protected] | Source CodeVendor |
| https://github.com/rgrove/crass/releases/tag/v1.0.8 | [email protected] | Release NotesVendor |
| https://github.com/rgrove/crass/security/advisories/GHSA-pq4g-8rxf-4g29 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-436 | Interpretation Conflict | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Crass | <= 1.0.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |