CVE-2026-116695

The Crass Ruby CSS parser (prior to version 1.0.8 ) is vulnerable to a CSS sanitizer bypass due to incorrect tokenization of bad URLs. The parser treats a closing parenthesis following an escaped backslash as escaped, causing it to retain declarations or style rules within a bad URL token that a ...