Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

crass

4 known vulnerabilities (4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 4 medium
Registry
RubyGems

Advisories 4

  • CVE-2026-61848Medium 6.3

    Crass: Non-ASCII characters cause superlinear CPU consumption

    Affected: fixed in 1.0.7.

  • CVE-2026-61847Medium 6.3

    Crass: A large number of adjacent CSS comments can trigger a SystemStackError

    Affected: fixed in 1.0.7.

  • CVE-2026-61846Medium 6.3

    Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage

    Affected: fixed in 1.0.7.

  • CVE-2026-116695Medium 5.3

    Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

    Affected: fixed in 1.0.8.