CVE-2026-116695 rgrove CVE debrief

Who should care

Defenders responsible for RubyGems packages, particularly those using Crass for CSS sanitization, should assess exposure and verify remediation to prevent potential security issues.

Why it matters

CVE-2026-116695 allows CSS sanitizers to pass through potentially malicious declarations, style rules, or at-rules due to incorrect tokenization of bad URLs in Crass. Defenders should assess exposure, verify remediation, and review CSS sanitizer configurations.

• Defenders must verify Crass versions and upgrade to 1.0.8 or later to prevent potential security issues.
• CSS sanitizer configurations may need to be reviewed and updated to ensure proper handling of untrusted CSS input.
• Exposure assessment is required for Crass versions 0.0.1 through 1.0.7.

Technical summary

The Crass tokenizer incorrectly terminates bad URL tokens at a `)` that follows an escaped backslash (`<backslash><backslash>`). This allows CSS sanitizers to pass through declarations, style rules, or at-rules that would otherwise be removed, potentially leading to security issues. The bug has existed in every released version of Crass, affecting versions 0.0.1 through 1.0.7. Defenders should prioritize assessing exposure and verifying remediation for these versions, as the incorrect tokenization can lead to the bypass of security features in CSS sanitizers. The issue can be mitigated by upgrading to Crass version 1.0.8 or later and reviewing CSS sanitizer configurations.

Defensive priority

Defenders should prioritize assessing exposure and verifying remediation for Crass versions 0.0.1 through 1.0.7, as the bug has existed in every released version.

Recommended defensive actions

• Assess exposure for Crass versions 0.0.1 through 1.0.7
• Verify remediation by upgrading to Crass version 1.0.8 or later
• Review and update CSS sanitizer configurations to ensure proper handling of untrusted CSS input
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the Crass tokenizer bug, its impact on CSS sanitizers, and the affected versions. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information, requiring verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.