## Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

- 種別: advisory
- 重大度: medium
- 関連技術: ruby
- CVE: CVE-2026-116695
- 公開日時: 2026-10-28T22:42:53.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-pq4g-8rxf-4g29)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-pq4g-8rxf-4g29

影響: rubygems:crass <= 1.0.7 → 1.0.8
Crass's tokenizer didn't terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing through declarations, style rules, or at-rules (including @import) that the sanitizer would otherwise have removed, but that a browser would then parse and apply. Details While consuming the remnants of a b…