A large number of adjacent CSS comments can trigger a SystemStackError
Published: June 25, 2026
SECURITY IDENTIFIERS
- CVE: CVE-2026-61847 (NVD)
- GHSA: GHSA-wwpr-jff3-395c
- Vendor Advisory: https://github.com/rgrove/crass/security/advisories/GHSA-wwpr-jff3-395c
GEM
PATCHED VERSIONS
>= 1.0.7
DESCRIPTION
Impact
When the :preserve_comments option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError.
RELATED
- https://www.cve.org/CVERecord?id=CVE-2026-61847
- https://rubygems.org/gems/crass/versions/1.0.7
- https://github.com/rgrove/crass/releases/tag/v1.0.7
- https://github.com/rgrove/crass/blob/v1.0.7/HISTORY.md#107-2026-06-25
- https://github.com/rgrove/crass/commit/25d78cc607c54262e9d43ea1930f3ba5bb03dfb5
- https://advisories.gitlab.com/gem/crass/CVE-2026-61847
- https://github.com/rgrove/crass/security/advisories/GHSA-wwpr-jff3-395c
- https://github.com/advisories/GHSA-wwpr-jff3-395c