{"id":"GHSA-wwpr-jff3-395c","aliases":["CVE-2026-61847"],"title":"Crass: A large number of adjacent CSS comments can trigger a SystemStackError","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Impact\n\nWhen the `:preserve_comments` option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a `SystemStackError`.\n\n### Patches\n\nThis is fixed in Crass 1.0.7, which no longer recurses when discarding comments.\n\n### Workarounds\n\nSet the `:preserve_comments` option to `true` if this is acceptable to your use case (recursion doesn't occur when comments are preserved).","severity":"medium","score":6.3,"published":"2026-10-29T16:35:23.000Z","modified":"2026-10-30T22:15:42.844Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"RubyGems","name":"crass","sources":[{"name":"OSV · GHSA-wwpr-jff3-395c","url":"https://osv.dev/vulnerability/GHSA-wwpr-jff3-395c"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.0.7"}],"type":"ECOSYSTEM"}],"versions":["0.0.1","0.0.2","0.1.0","0.2.0","0.2.1","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6"],"fixed":["1.0.7"]}],"sourceAffected":[],"references":["https://github.com/rgrove/crass/security/advisories/GHSA-wwpr-jff3-395c","https://github.com/rgrove/crass/commit/25d78cc607c54262e9d43ea1930f3ba5bb03dfb5","https://github.com/rgrove/crass","https://github.com/rgrove/crass/releases/tag/v1.0.7"],"sources":[{"name":"OSV","id":"GHSA-wwpr-jff3-395c","modified":"2026-10-29T16:45:06.064429996Z","url":"https://osv.dev/vulnerability/GHSA-wwpr-jff3-395c"},{"name":"CVE","id":"CVE-2026-61847","modified":"2026-10-30T22:15:42.844Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-61847"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","score":6.3},{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","score":6.3}],"cve":{"records":[{"id":"CVE-2026-61847","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-10T20:28:17.513Z","published":"2026-10-30T18:44:22.330Z","modified":"2026-10-30T22:15:42.844Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T18:44:22.330Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T22:15:42.844Z"}],"references":[{"url":"https://github.com/rgrove/crass/security/advisories/GHSA-wwpr-jff3-395c","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/rgrove/crass/commit/25d78cc607c54262e9d43ea1930f3ba5bb03dfb5","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/rgrove/crass/releases/tag/v1.0.7","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-674","description":"CWE-674: Uncontrolled Recursion","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T21:18:11.231526Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"products":[{"vendor":"rgrove","name":"crass","platforms":[],"versions":[{"version":"< 1.0.7","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-61847"}],"remediation":[],"observedAt":"2026-10-30T22:48:02.794Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T07:50:32.196Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-29T17:00:34.185Z","attemptedAt":"2026-10-29T17:00:34.185Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T17:00:34.441Z","attemptedAt":"2026-10-29T17:00:34.441Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-29T17:00:33.893Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T17:00:33.693Z","attemptedAt":"2026-10-29T17:00:33.693Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-wwpr-jff3-395c","url":"https://github.com/advisories/GHSA-wwpr-jff3-395c","modified":"2026-10-29T16:35:23Z","checkedAt":"2026-10-29T17:00:34.441Z"}],"aiSummary":null}