SSRF and local file disclosure in css_parser (RubyGems) (CVE-2026-53727)

CVE-2026-53727 is a Server-Side Request Forgery (SSRF) and local file disclosure vulnerability in the `css_parser` RubyGems package affecting `CssParser::Parser#read_remote_file`, which issues HTTP/HTTPS requests against any host, port, and URI with no scheme allowlist, host/IP filtering, or protection against loopback, RFC-1918, or link-local addresses. Because the function also services `file://` URIs and recursively follows `Location:` redirects back into itself, an attacker-controlled HTTP redirect can escalate the SSRF to arbitrary local file read. Any application that passes attacker-influenced CSS to `css_parser` with a `base_uri:` option - including all Premailer pipelines - is exposed via a single `@import url(...)` rule. Public POC available. Affected versions: - 2.2.0 We recommend updating to: 3.0.0. CVSS 8.9 · our assessment: this_week Vendor advisory: https://github.com/premailer/css_parser/security/advisories/GHSA-9pmc-p236-855h Details: https://vuln.today/cve/CVE-2026-53727