CVE-2026-116695 with a CVSS score of 3.0 is a CSS sanitization bypass in the Crass Ruby library, affecting crass (rubygems) versions <= 1.0.7. The flaw is incorrect tokenization of bad URL tokens: after an escaped backslash, the tokenizer treated a following closing parenthesis as escaped, so it consumed more input as part of the bad URL than a spec-compliant browser would. A remote attacker can exploit this by supplying crafted CSS to an application that uses Crass to parse untrusted CSS and re-emit it, provided the sanitizer does not reject bad URL tokens wherever they occur. The attacker does not need authentication, but user interaction is required when the sanitized CSS is rendered. The result is that declarations, style rules, or at-rules that should have been removed can pass through, enabling UI redress such as clickjacking or phishing overlays, loading attacker-controlled external resources, and, where rules or imports can be smuggled, CSS-based data exfiltration. The issue does not allow script execution in modern browsers.
We recommend you to update Crass to version 1.0.8.[/subscribe_to_unlock_form]
CVE-2026-116695 with a CVSS score of 3.0 is a CSS sanitization bypass in the Crass Ruby library, affecting crass (rubygems) versions <= 1.0.7. The flaw is incorrect tokenization of bad URL tokens: after an escaped backslash, the tokenizer treated a following closing parenthesis as escaped, so it consumed more input as part of the bad URL than a spec-compliant browser would. A remote attacker can exploit this by supplying crafted CSS to an application that uses Crass to parse untrusted CSS and re-emit it, provided the sanitizer does not reject bad URL tokens wherever they occur. The attacker does not need authentication, but user interaction is required when the sanitized CSS is rendered. The result is that declarations, style rules, or at-rules that should have been removed can pass through, enabling UI redress such as clickjacking or phishing overlays, loading attacker-controlled external resources, and, where rules or imports can be smuggled, CSS-based data exfiltration. The issue does not allow script execution in modern browsers.
We recommend you to update Crass to version 1.0.8.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]