crass
RubyGems5 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting crasspage 1 of 1
- CVE-2026-116695MEDIUMCVSS 5.3EG 5.3fixed in 1.0.82026-10-27
vulnerable: 0.0.1 ... 1.0.7 (13 versions)
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass t…
- CVE-2026-61845HIGHCVSS 8.9EG 8.9fixed in 1.0.72026-10-20
vulnerable: 0.0.1 ... 1.0.6 (12 versions)
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`. A…
- CVE-2026-61846MEDIUMCVSS 6.3EG 6.3fixed in 1.0.72026-10-29
vulnerable: 0.0.1 ... 1.0.6 (12 versions)
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses `CSS simple blocks and functions` without a depth guard. An attacker-controlled CSS value containing deep…
- CVE-2026-61847MEDIUMCVSS 6.3EG 6.3fixed in 1.0.72026-10-29
vulnerable: 0.0.1 ... 1.0.6 (12 versions)
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming th…
- CVE-2026-61848MEDIUMCVSS 6.3EG 6.3fixed in 1.0.72026-10-29
vulnerable: 0.0.1 ... 1.0.6 (12 versions)
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing `non-ASCII characters`, inefficiencies in tracking the positions of `multi-byte characters` res…
Check whether crass is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for crass CVEs against the assets you own.
Book a Demo →