CVE-2026-44312
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation.
Risk Assessment
A MITM attacker can modify loaded CSS stylesheets, potentially injecting malicious content or leaking data. The risk affects Ruby applications using css_parser to fetch remote stylesheets over HTTPS.
Recommendation
Update the css_parser gem to version 2.1.0 or 1.22.0 (or later). Until patched, avoid loading stylesheets over HTTPS from untrusted sources.
Other vulnerabilities in css_parser
See all- GHSA-w3mx-4vv9-hjpgMedium
When css_parser parses CSS containing an @import rule and the caller has supplied a :base_dir option (but not a :base_uri), the attacker-controlled import path is passed directly into load_file!, which does File.expand_path(file_name, base_dir) followed by File.read with no path containment.
- GHSA-84w7-hpvm-rxx2Unknown
expand_shorthand! (and the expand_dimensions_shorthand! it calls) runs the RE_FUNCTIONS regex over declaration values. That regex has a nested quantifier inside a group that can recurse, so on a value that opens a CSS function and never closes it, the match degrades into exponential backtracking.
- CVE-2026-53727High
SSRF vulnerability in the Ruby css_parser library versions 2.2.0 through 3.0.0. The read_remote_file method makes HTTP/HTTPS requests to any host without filtering, and redirects can lead to local file disclosure via file:// URIs.
Original NVD description (English source)
css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation. This vulnerability is fixed in 2.1.0 and 1.22.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS