CVE-2026-116695

Summary

Crass's tokenizer didn't terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing through declarations, style rules, or at-rules (including @import) that the sanitizer would otherwise have removed, but that a browser would then parse and apply.

Details

While consuming the remnants of a bad URL (CSS Syntax Level 3, §4.3.15), Crass checked whether the previously consumed code point and the next code point formed a valid escape, in addition to checking the next two unconsumed code points. After an escaped backslash, the previously consumed code point is a backslash, so a following ) was incorrectly treated as escaped and the bad URL token continued until the next unescaped ) or the end of the input.

Browsers terminate the bad URL at that ), so everything Crass treated as part of the bad URL is live CSS to a browser.

This bug has existed in every released version of Crass.

Impact

Crass by itself only mis-tokenizes input. The security impact is on CSS sanitizers that use Crass to make allow/deny decisions and then re-serialize the CSS. Exploitation requires a sanitizer that doesn't reject bad URL tokens wherever they occur. Confirmed examples (verified in Chromium against the sanitizers' output):

• Sanitize (all versions through 7.0.0):
  • In Sanitize::CSS.properties and style attributes, a bad URL inside a [...] or (...) block in the value of an allowlisted property can smuggle arbitrary declarations, such as position: fixed or a background-image URL with a disallowed protocol.
  • In Sanitize::CSS.stylesheet and <style> elements, a bad URL in a selector can smuggle arbitrary style rules and at-rules, including @import.
• Loofah (Loofah::HTML5::Scrub.scrub_css, used for style attributes), and therefore rails-html-sanitizer (sanitize_css, and sanitize when style is a permitted attribute): a bad URL inside an allowlisted function such as calc() or rgb() can smuggle declarations Loofah normally strips, such as position: fixed and url() values.

Smuggled CSS can be used for UI redress (clickjacking or phishing overlays), loading attacker-controlled external resources, and, where rules or @import can be smuggled, CSS-based data exfiltration. This vulnerability doesn't allow script execution in modern browsers.

Patches

Fixed in Crass 1.0.8. Users of Sanitize, Loofah, rails-html-sanitizer, or any other library that uses Crass to sanitize CSS should upgrade Crass to 1.0.8 or later.

Workarounds

There are no practical workarounds other than upgrading. Rejecting any CSS input that contains the character sequence \\ would block the known trigger, but this is a blunt measure and may reject legitimate CSS.

References

• CSS Syntax Module Level 3, "Consume the remnants of a bad url": https://drafts.csswg.org/css-syntax-3/#consume-remnants-of-bad-url

Crass is a pure Ruby CSS parser based on the CSS Syntax Level 3 spec.

Security Fix(es):

Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8.(CVE-2026-116695)

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises SystemStackError: stack level too deep, or cause excessive memory usage. Version 1.0.7 adds a configurable depth limit with a conservative default. This issue is fixed in version 1.0.7.(CVE-2026-61846)

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preserve_comments option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7.(CVE-2026-61847)

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS input consisting of many non-ASCII characters can therefore cause excessive CPU consumption and potentially denial of service. This issue is fixed in version 1.0.7.(CVE-2026-61848)

Crass is a pure Ruby CSS parser based on the CSS Syntax Level 3 spec.

Security Fix(es):

Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8.(CVE-2026-116695)

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises SystemStackError: stack level too deep, or cause excessive memory usage. Version 1.0.7 adds a configurable depth limit with a conservative default. This issue is fixed in version 1.0.7.(CVE-2026-61846)

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preserve_comments option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7.(CVE-2026-61847)

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS input consisting of many non-ASCII characters can therefore cause excessive CPU consumption and potentially denial of service. This issue is fixed in version 1.0.7.(CVE-2026-61848)

Crass is a pure Ruby CSS parser based on the CSS Syntax Level 3 spec.

Security Fix(es):

Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8.(CVE-2026-116695)

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises SystemStackError: stack level too deep, or cause excessive memory usage. Version 1.0.7 adds a configurable depth limit with a conservative default. This issue is fixed in version 1.0.7.(CVE-2026-61846)

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the :preserve_comments option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7.(CVE-2026-61847)

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing non-ASCII characters, inefficiencies in tracking the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled CSS input consisting of many non-ASCII characters can therefore cause excessive CPU consumption and potentially denial of service. This issue is fixed in version 1.0.7.(CVE-2026-61848)

Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8.