In short
- CVE-2026-61847 is a MEDIUM (CVSS 6.3) vulnerability affecting crass.
- Chance of exploitation in the next 30 days (EPSS): 0.49%, higher than 41.8% of all vulnerabilities.
- Fix: update to 1.0.7 or later.
| Package | Affected versions | Patched versions |
|---|
| crass RubyGems | < 1.0.7
| 1.0.7
|
Description
Impact
When the :preserve_comments option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError.
Patches
This is fixed in Crass 1.0.7, which no longer recurses when discarding comments.
Workarounds
Set the :preserve_comments option to true if this is acceptable to your use case (recursion doesn't occur when comments are preserved).
NVD description
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a `SystemStackError`, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free