Log in Start free

Vulnerability · Published Oct 27, 2026 · Assigned by GitHub_M

CVE-2026-116695Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

Medium 5.3

In plain English

A medium-severity security flaw in crass from rgrove. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.3Medium
Exploit odds (30 days)0.4%top 70.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ruby-crassno fix listedDEBIAN-CVE-2026-116695
Debian:13ruby-crassno fix listedDEBIAN-CVE-2026-116695
Debian:14ruby-crass1.0.8-1DEBIAN-CVE-2026-116695
RubyGemscrass1.0.8GHSA-pq4g-8rxf-4g29
Ubuntu:22.04:LTSruby-crassno fix listedUBUNTU-CVE-2026-116695
Ubuntu:24.04:LTSruby-crassno fix listedUBUNTU-CVE-2026-116695
Ubuntu:26.04:LTSruby-crassno fix listedUBUNTU-CVE-2026-116695
Ubuntu:26.10ruby-crassno fix listedUBUNTU-CVE-2026-116695

Affected products (as reported)

VendorProductVersions
rgrove crass < 1.0.8

Weakness: CWE-436 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References