p PatchFirst

CVE-2026-116695

CVE-2026-116695 · Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8.

CVSS 5.3 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • crass

    Versions
    • < 1.0.8: Affected

    No fix published

  • ruby-crass Debian:12

    Versions
    • 1.0.2-3
    • 1.0.6-1
    • 1.0.7-1
    • 1.0.8-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-crass Debian:13

    Versions
    • 1.0.6-1
    • 1.0.7-1
    • 1.0.8-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-crass Debian:14

    Versions
    • 1.0.6-1
    • 1.0.7-1
    Affected ranges
    • ECOSYSTEM: < 1.0.8-1

    Update to 1.0.8-1

  • ruby-crass Ubuntu:16.04:LTS

    Versions
    • 1.0.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-crass Ubuntu:18.04:LTS

    Versions
    • 1.0.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-crass Ubuntu:20.04:LTS

    Versions
    • 1.0.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-crass Ubuntu:22.04:LTS

    Versions
    • 1.0.2-2.1
    • 1.0.2-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-crass Ubuntu:24.04:LTS

    Versions
    • 1.0.2-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-crass Ubuntu:26.10

    Versions
    • 1.0.6-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-crass Ubuntu:26.04:LTS

    Versions
    • 1.0.6-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →