crass

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium6.3

GHSA-8vfg-2r28-hvhjFix available

Crass: Non-ASCII characters cause superlinear CPU consumption

RubyGems / crass

2 days ago

crass RubyGems

Affected range	Recorded fix
Earlier releases before 1.0.7Ecosystem versions	1.0.7

Version evidence: OSV · GHSA-8vfg-2r28-hvhj

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.0.7"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.0.1",
    "0.0.2",
    "0.1.0",
    "0.2.0",
    "0.2.1",
    "1.0.0",
    "1.0.1",
    "1.0.2",
    "1.0.3",
    "1.0.4",
    "1.0.5",
    "1.0.6"
  ]
}

medium6.3

GHSA-wwpr-jff3-395cFix available

Crass: A large number of adjacent CSS comments can trigger a SystemStackError

RubyGems / crass

2 days ago

crass RubyGems

Affected range	Recorded fix
Earlier releases before 1.0.7Ecosystem versions	1.0.7

Version evidence: OSV · GHSA-wwpr-jff3-395c

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.0.7"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.0.1",
    "0.0.2",
    "0.1.0",
    "0.2.0",
    "0.2.1",
    "1.0.0",
    "1.0.1",
    "1.0.2",
    "1.0.3",
    "1.0.4",
    "1.0.5",
    "1.0.6"
  ]
}

medium6.3

GHSA-6jxj-px6v-747wFix available

Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage

RubyGems / crass

2 days ago

crass RubyGems

Affected range	Recorded fix
Earlier releases before 1.0.7Ecosystem versions	1.0.7

Version evidence: OSV · GHSA-6jxj-px6v-747w

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.0.7"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.0.1",
    "0.0.2",
    "0.1.0",
    "0.2.0",
    "0.2.1",
    "1.0.0",
    "1.0.1",
    "1.0.2",
    "1.0.3",
    "1.0.4",
    "1.0.5",
    "1.0.6"
  ]
}

medium5.3

CVE-2026-116695Fix available

Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

RubyGems / crass

4 days ago

crass RubyGems

Affected range	Recorded fix
Earlier releases before 1.0.8Ecosystem versions	1.0.8

Version evidence: OSV · GHSA-pq4g-8rxf-4g29

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.0.8"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.0.1",
    "0.0.2",
    "0.1.0",
    "0.2.0",
    "0.2.1",
    "1.0.0",
    "1.0.1",
    "1.0.2",
    "1.0.3",
    "1.0.4",
    "1.0.5",
    "1.0.6",
    "1.0.7"
  ]
}