CSS Parser EUVD-2026-30330

The vulnerability requires two specific conditions: first, the application must call CSS Parser to load stylesheets from HTTPS URLs (either directly via css_parser gem or indirectly through a dependency); second, an attacker must be positioned on the network path between the application and the remote stylesheet host to intercept and modify the HTTPS traffic. CSS Parser will not validate any HTTPS certificate when loading remote stylesheets, regardless of the certificate's validity or issuer. No special configuration or non-default settings are required-the vulnerability is present by default in all versions < 2.1.0 when loading stylesheets via HTTPS. The impact is limited to CSS injection and content manipulation; it does not directly enable remote code execution on the application server unless the application uses parsed CSS in an unsafe context (e.g., evaluating CSS as code).

CVSS 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) correctly indicates network-based attack requiring low complexity and no user interaction, with integrity impact across scope boundaries. However, real-world risk is conditional on deployment context: if the application loads stylesheets only from trusted first-party HTTPS sources over secure networks, practical exploitation is unlikely; if stylesheets are loaded from third-party URLs or over untrusted networks (public WiFi, ISP-level compromise, state-level interception), risk is substantially higher. The absence of EPSS score and KEV listing suggests this is not yet confirmed as actively exploited in the wild, though a public proof-of-concept exists and the attack is trivially reproducible with standard MITM tools (mitmproxy, Burp Suite). This is a real vulnerability with clear exploitation prerequisites: the attacker must be on the network path AND the application must load stylesheets via HTTPS. Organizations with network segmentation and TLS traffic inspection should assess whether their deployment model creates exposure. The patch (version 2.1.0) is available and straightforward to apply, making this a high-priority remediation for affected applications without special constraints.

An attacker on a network path (compromised WiFi router, ISP, or BGP hijack) intercepts HTTPS requests from an application using CSS Parser to load a remote stylesheet (e.g., https://cdn.example.com/style.css). The attacker presents a self-signed certificate, which CSS Parser accepts due to disabled validation. The attacker injects malicious CSS into the response-such as hiding elements, stealing form data via CSS attribute selectors, or defacing the page layout. The application receives and renders the injected CSS without warning, and users see the attacker-controlled content.