CVE-2026-53727 Details
Description
css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_remote_file in lib/css_parser/parser.rb, and therefore load_uri! and the @import-following branch of add_block!, issued HTTP and HTTPS requests against any host, port, and URI without a scheme allowlist, host or IP filtering, or protection against link-local, loopback, or RFC-1918 addresses. Location: redirects were followed recursively back into the same function, which also serviced file:// URIs, so a single attacker-controlled HTTP redirect could upgrade the bug from SSRF to arbitrary local file disclosure. Any consumer of css_parser that hands it attacker-influenced CSS together with a base_uri: option is exposed. This issue is fixed in version 3.0.0.
A vulnerability in the CssParser Ruby library, specifically in the CSS parsing component, versions 2.2.0 prior to 3.0.0, allows for server-side request forgery (SSRF) and arbitrary local file inclusion. The issue arises in the 'read_remote_file' method, which handles HTTP and HTTPS requests without proper validation or filtering. This lack of oversight enables an attacker to exploit the library by sending manipulated CSS that is processed in a way that triggers the vulnerability. The 'file://' URI scheme is also mishandled, allowing for local file reads through an HTTP redirect. The vulnerability is particularly concerning for applications like Premailer that use CssParser to process user-influenced CSS.
Users can upgrade to CssParser version 3.0.0, which addresses the vulnerability by routing HTTP requests through the 'ssrf_filter' gem, removing 'file://' URIs from the remote fetch path, and adding two opt-in flags to control the previous behavior.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| premailer css parser | 2.2.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 18, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |