Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

影響: rubygems:crass <= 1.0.7 → 1.0.8

Crass's tokenizer didn't terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing through declarations, style rules, or at-rules (including @import) that the sanitizer would otherwise have removed, but that a browser would then parse and apply. Details While consuming the remnants of a b…

GitHub Advisory Databaseで読む

2026/10/29 07:42、GitHub Advisory Databaseが「Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Ruby。CVE: CVE-2026-116695。