Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

影響: rubygems:crass <= 1.0.7 → 1.0.8

Crass's tokenizer didn't terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing through declarations, style rules, or at-rules (including @import) that the sanitizer would otherwise have removed, but that a browser would then parse and apply. Details While consuming the remnants of a b…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 07:42, GitHub Advisory Database에서 "Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Ruby. CVE: CVE-2026-116695.