CVE-2026-116695

A flaw was found in Crass. When parsing malformed URL tokens containing escaped backslashes, Crass incorrectly treats the closing parenthesis as escaped, retaining style declarations that web browsers interpret as active Cascading Style Sheets CSS. A remote attacker could supply crafted CSS to an...