UBUNTU-CVE-2026-116695: Medium severity ubuntu/ruby-crass vulnerability
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Crassto a version that resolves this vulnerability.Fixed in 1.0.8
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that accept untrusted CSS, parse it with Crass, and reserialize or allow the resulting CSS without rejecting malformed URL tokens are exposed. The issue is relevant when that CSS is later interpreted by a browser.
What must an attacker provide to exploit it?
An attacker must be able to supply CSS containing a malformed URL with a closing parenthesis after an escaped backslash. They also need the application to sanitize or process that CSS with the affected Crass behavior and deliver the output to a browser.
What can an attacker achieve?
The parser discrepancy can preserve declarations, style rules, or at-rules that a browser treats as live CSS. This can support UI redress, external resource loading, or CSS-based data exfiltration, but does not enable script execution in modern browsers.
How can this be remediated?
Update Crass to version 1.0.8 or later. If updating is not immediately possible, reject untrusted CSS containing malformed URL tokens rather than reserializing it through the affected parser.
How can I determine whether my application is affected?
Check whether the application uses ruby-crass before version 1.0.8 and processes attacker-controlled CSS. Review whether malformed CSS URLs are accepted and reserialized, particularly URLs containing an escaped backslash followed by a closing parenthesis.