EUVD-2026-41694Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local execution requiring low privileges to invoke the compiler; impact is limited to availability of the compiler process with no confidentiality, integrity, or scope-change effects.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in connorskees grass up to 0.13.4. The affected element is the function grass_compiler::raw_to_parse_error of the component UTF-8 Character Handler. Executing a manipulation can lead to denial of service. The attack is restricted to local execution. The exploit has been published and may be used. In Issue #117 with similar structure the project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."
AnalysisAI
Local denial-of-service in the grass Rust-based Sass compiler (versions up to and including 0.13.4) is triggerable by a local, low-privileged user who supplies crafted UTF-8 input to the grass_compiler::raw_to_parse_error function. Publicly available exploit code exists (CVSS 4.0 E:P), though no CISA KEV listing has been issued. The project maintainer has explicitly stated in Issue #117 that DoS in Sass compilers is considered acceptable behavior due to the inherently exponential nature of the @extend algorithm and other compile-time constructs, significantly reducing the urgency of a vendor-released fix.
Technical ContextAI
grass is an open-source, Rust-language implementation of the Sass/SCSS stylesheet preprocessor, maintained by connorskees on GitHub. The vulnerable component is grass_compiler::raw_to_parse_error, which handles UTF-8 character decoding during compilation. CWE-404 (Improper Resource Shutdown or Release) indicates the function fails to properly manage resources when encountering specific crafted UTF-8 sequences, leading to process-level availability failure. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) confirms the impact is strictly local and limited to the compiler's own availability - no confidentiality or integrity impact on the vulnerable system, and no scope change affecting subsequent systems. The maintainer's note about @extend being 'definitionally exponential' further contextualizes this as a class of compile-time resource exhaustion inherent to the Sass specification itself.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project maintainer's response in Issue #117 indicates DoS in Sass compilers is considered expected behavior, making an official fix uncertain. The most actionable compensating control is to avoid compiling untrusted or user-supplied SCSS/Sass input with the grass compiler in automated or unattended contexts (e.g., CI/CD pipelines). If untrusted input must be processed, run the grass compiler in an isolated process or container with resource limits (e.g., ulimit -t for CPU time, ulimit -v for memory) to cap the blast radius of a DoS attempt to the sandboxed process rather than the host system. Restricting who can submit input to the compiler (i.e., enforcing PR:L boundary controls) is itself a mitigation, as the CVSS vector already requires low-privilege local access. Monitor https://github.com/connorskees/grass for a future patched release.
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today