Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

影響: rubygems:crass <= 1.0.7 → 1.0.8

Crass's tokenizer didn't terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing through declarations, style rules, or at-rules (including @import) that the sanitizer would otherwise have removed, but that a browser would then parse and apply. Details While consuming the remnants of a b…

Read on GitHub Advisory Database

On 10/29/2026, 07:42 AM, GitHub Advisory Database published "Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass" (type: Advisory). Severity is "Medium" (medium). Related technologies: Ruby. CVE: CVE-2026-116695.