CVE-2026-44312 Details
Description
css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation. This vulnerability is fixed in 2.1.0 and 1.22.0.
A vulnerability exists in the css_parser gem for Ruby, specifically in versions prior to 2.1.0 and 1.22.0. The parser fails to validate HTTPS connections, which can enable a Man-in-the-Middle (MITM) attacker to inject or alter CSS content when stylesheets are loaded over HTTPS. This issue arises because the connection is established with OpenSSL::SSL::VERIFY_NONE, accepting any HTTPS certificate without proper validation. As a result, intercepted CSS can be modified before it reaches the application.
Users can upgrade to css_parser version 2.1.0 or 1.22.0, both of which address this vulnerability by properly validating HTTPS connections.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 14, 2026CISA-ADP
Assessed May 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/premailer/css_parser/commit/35e689c904225add78e0c488cf04bad052666449 | [email protected] | Source CodeVendor |
| https://github.com/premailer/css_parser/commit/e0c95d5abe91b237becb90ff316531a6547ada18 | [email protected] | Source CodeVendor |
| https://github.com/premailer/css_parser/issues/185 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| css_parser | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | New CVE Received | [email protected] |