Crass
Monthly
CSS sanitizer bypass in Crass, the Ruby CSS parser, affects versions prior to 1.0.8 and allows unauthenticated remote attackers to smuggle declarations, style rules, or at-rules past sanitizers that parse untrusted CSS with Crass and re-serialize it without rejecting bad URL tokens. Confirmed downstream impact requires a vulnerable sanitizer such as Sanitize through 7.0.0, Loofah's scrub_css, or rails-html-sanitizer, and a victim rendering the sanitized output; the result is limited to UI redress, external resource loading, or CSS-based data exfiltration, not script execution in modern browsers. No public exploit identified at time of analysis, and the vendor has released Crass 1.0.8 as the fix.
CSS sanitizer bypass in Crass, the Ruby CSS parser, affects versions prior to 1.0.8 and allows unauthenticated remote attackers to smuggle declarations, style rules, or at-rules past sanitizers that parse untrusted CSS with Crass and re-serialize it without rejecting bad URL tokens. Confirmed downstream impact requires a vulnerable sanitizer such as Sanitize through 7.0.0, Loofah's scrub_css, or rails-html-sanitizer, and a victim rendering the sanitized output; the result is limited to UI redress, external resource loading, or CSS-based data exfiltration, not script execution in modern browsers. No public exploit identified at time of analysis, and the vendor has released Crass 1.0.8 as the fix.