Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

影響: rubygems:crass <= 1.0.7 → 1.0.8

Crass's tokenizer didn't terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing through declarations, style rules, or at-rules (including @import) that the sanitizer would otherwise have removed, but that a browser would then parse and apply. Details While consuming the remnants of a b…

在 GitHub Advisory Database 阅读

2026/10/29 07:42，GitHub Advisory Database 发布了“Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Ruby。CVE：CVE-2026-116695。