CVE-2026-14651
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability was found in grass up to version 0.13.4 in the functions grass_compiler::selector::extend and grass_compiler::evaluate::visitor, allowing a local denial of service attack. The maintainer states that DoS vulnerabilities are generally acceptable in Sass compilers due to the exponential nature of the @extend algorithm.
Risk Assessment
The risk for the organization is a potential local system overload by intentionally triggering compiler functions, leading to temporary unavailability of services for other users.
Recommendation
It is recommended to update the grass library to the latest version if available, or to apply time limits for compilation operations in local environments.
Original NVD description (English source)
A vulnerability has been found in connorskees grass up to 0.13.4. The impacted element is the function grass_compiler::selector::extend/grass_compiler::evaluate::visitor. The manipulation leads to denial of service. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."