CVE-2026-61846

The Crass Ruby CSS parser is vulnerable to uncontrolled recursion (CWE-674) in versions prior to 1.0.7 . The parser lacks a depth guard when recursively processing CSS simple blocks and functions , allowing an attacker-controlled CSS value with deeply nested structures to trigger a SystemStackErr...