{"id":"ghsa-ghsa-pq4g-8rxf-4g29","seq":2056907,"kind":"advisory","title":"Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass","url":"https://github.com/advisories/GHSA-pq4g-8rxf-4g29","permalink":"https://vulnpulse.app/items/ghsa-ghsa-pq4g-8rxf-4g29","summary":"影響: rubygems:crass <= 1.0.7 → 1.0.8\nCrass's tokenizer didn't terminate a bad URL token at a ) that followed an escaped backslash (\\\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing through declarations, style rules, or at-rules (including @import) that the sanitizer would otherwise have removed, but that a browser would then parse and apply. Details While consuming the remnants of a b…","severity":"medium","techs":["ruby"],"cves":["CVE-2026-116695"],"tags":["GHSA-pq4g-8rxf-4g29","crass"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T22:42:53.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}