grass Sass Compiler
CVE-2026-14651
LOW
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and low privileges required to invoke the compiler; only availability of the compiler process is impacted at low severity.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in connorskees grass up to 0.13.4. The impacted element is the function grass_compiler::selector::extend/grass_compiler::evaluate::visitor. The manipulation leads to denial of service. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."
AnalysisAI
Denial-of-service in the grass Sass compiler (up to v0.13.4) allows a local attacker with low privileges to trigger exponential resource consumption via a crafted stylesheet using the CSS @extend directive. The affected functions are grass_compiler::selector::extend and grass_compiler::evaluate::visitor, where the @extend algorithm's inherently exponential complexity can be exploited with a maliciously constructed input to hang or crash the compiler process. A public exploit has been disclosed; however, the project maintainer explicitly contests the severity, noting that DoS conditions are an accepted and expected limitation of Sass compilers by design.
Technical ContextAI
Grass is an open-source Sass/SCSS compiler written in Rust, maintained by connorskees (CPE: cpe:2.3:a:connorskees:grass:*:*:*:*:*:*:*:*). The vulnerability is rooted in the algorithmic complexity of the CSS @extend selector resolution logic. CWE-404 (Improper Resource Shutdown or Release) is assigned, though the root cause is more precisely an unbounded algorithmic complexity issue - the @extend algorithm is, by the maintainer's own admission, definitionally exponential in its worst-case behavior. This means a specially crafted @extend chain in a Sass input file can cause the compiler to consume excessive CPU or memory, resulting in a denial of service of the compilation process. This is a compile-time vulnerability, not a runtime one - it affects developer tooling or build pipelines that invoke the grass compiler, not deployed web applications.
RemediationAI
No vendor-released patch has been identified at time of analysis, and the project maintainer has explicitly stated this is not considered a vulnerability requiring remediation. If grass is used in automated build pipelines or CI/CD environments that process untrusted Sass input, the most effective compensating control is to restrict input sources to trusted internal stylesheets only - do not compile externally sourced or user-supplied .scss/.sass files with grass. Additionally, consider imposing a compilation timeout at the process level (e.g., via a wrapper script with a timeout command) to limit the impact of any runaway compilation - note this does not prevent the DoS but bounds its duration. If the compiler is invoked in a shared environment, sandboxing (e.g., via cgroups, Docker resource limits, or ulimit) can contain CPU/memory consumption. Switching to an alternative Sass compiler (e.g., dart-sass or LibSass) for production pipelines processing untrusted input is the most robust mitigation. See https://github.com/connorskees/grass/issues/117 for maintainer commentary.
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today