CVE-2026-14650
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A denial of service vulnerability has been found in the grass library up to version 0.13.4 in the grass_compiler::raw_to_parse_error function of the UTF-8 Character Handler component. A local attack can cause denial of service. The maintainer considers DoS vulnerabilities acceptable in Sass compilers.
Risk Assessment
The risk involves a local denial of service that could disrupt applications using the grass library. However, the attack requires local system access.
Recommendation
It is recommended to update the grass library to version 0.13.5 or later if available. If no update is available, restrict local system access and monitor library usage.
Original NVD description (English source)
A flaw has been found in connorskees grass up to 0.13.4. The affected element is the function grass_compiler::raw_to_parse_error of the component UTF-8 Character Handler. Executing a manipulation can lead to denial of service. The attack is restricted to local execution. The exploit has been published and may be used. In Issue #117 with similar structure the project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."