crass (RubyGems)
Advisories
5
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.0.8 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update crass # Gemfile: gem "crass", ">= 1.0.8"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-8vfg-2r28-hvhj Crass: Non-ASCII characters cause superlinear CPU consumption |
Medium EPSS 0.49% |
< 1.0.7 | 1.0.7 |
| GHSA-wwpr-jff3-395c Crass: A large number of adjacent CSS comments can trigger a SystemStackError |
Medium EPSS 0.49% |
< 1.0.7 | 1.0.7 |
| GHSA-6jxj-px6v-747w Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage |
Medium EPSS 0.49% |
< 1.0.7 | 1.0.7 |
| GHSA-pq4g-8rxf-4g29 Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass |
Medium EPSS 0.35% |
< 1.0.8 | 1.0.8 |
| GHSA-6wmf-3r64-vcwv Crass : Large numeric exponents cause CPU and memory denial of service |
High EPSS 0.39% |
< 1.0.7 | 1.0.7 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor