DailyCVE@dailycve
🟠 (Crass), Bad URL Tokenization, #CVE-2026-116695 (Medium) -DC-Oct2026-3926 https://dailycve.com/crass-bad-url-tokenization-cve-2026-116695-medium-dc-oct2026-3926/
0000025
247 followersView on X
CVE-2026-116695
LOWCVSS 5.3 · MEDIUMSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS. A sanitizer that parses untrusted CSS with Crass and reserializes it without rejecting the bad URL can allow CSS used for UI redress, external resource loading, or CSS-based data exfiltration, but this issue does not enable script execution in modern browsers. This issue is fixed in version 1.0.8.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-436
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day