{"affected":[{"product":"crass","source":"CNA: GitHub_M","vendor":"rgrove","versions":[{"status":"affected","version":"< 1.0.7"}]},{"defaultStatus":"unaffected","ecosystem":"RubyGems","packageName":"crass","product":"crass","source":"OSV GHSA-6jxj-px6v-747w","vendor":"","versions":[{"status":"affected","version":"0.0.1","versionType":"RubyGems"},{"status":"affected","version":"0.0.2","versionType":"RubyGems"},{"status":"affected","version":"0.1.0","versionType":"RubyGems"},{"status":"affected","version":"0.2.0","versionType":"RubyGems"},{"status":"affected","version":"0.2.1","versionType":"RubyGems"},{"status":"affected","version":"1.0.0","versionType":"RubyGems"},{"status":"affected","version":"1.0.1","versionType":"RubyGems"},{"status":"affected","version":"1.0.2","versionType":"RubyGems"},{"status":"affected","version":"1.0.3","versionType":"RubyGems"},{"status":"affected","version":"1.0.4","versionType":"RubyGems"},{"status":"affected","version":"1.0.5","versionType":"RubyGems"},{"status":"affected","version":"1.0.6","versionType":"RubyGems"},{"events":[{"introduced":"0"},{"fixed":"1.0.7"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-61846","cwes":["CWE-674"],"description":"Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses `CSS simple blocks and functions` without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raises `SystemStackError`: stack level too deep, or cause excessive memory usage. Version 1.0.7 adds a configurable depth limit with a conservative default. This issue is fixed in version 1.0.7.","epss":{"date":"2026-11-04","percentile":0.41938,"score":0.00486},"exploits":[],"kev":null,"metrics":[{"score":6.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","version":"4.0"}],"modifiedAt":1793845726025,"publishedAt":1793385805373,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/rgrove/crass/security/advisories/GHSA-6jxj-px6v-747w"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/rgrove/crass/commit/cf68287356ec6e20d51cfc4a2d0c3912b7334e99"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/rgrove/crass/releases/tag/v1.0.7"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-6jxj-px6v-747w"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-6jxj-px6v-747w"}],"remediation":[{"kind":"fix","source":"OSV GHSA-6jxj-px6v-747w","text":"crass (RubyGems): OSV reports a fixed version 1.0.7. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-6jxj-px6v-747w"}],"revision":"b62d85c9454bfa739fc6ff649b8a8562bc3f9ce0d5b3ff465100657a6666ce13","sources":[{"modifiedAt":1793845726025,"name":"CNA: GitHub_M","retrievedAt":1793848254426,"url":"https://www.cve.org/CVERecord?id=CVE-2026-61846"},{"modifiedAt":1793292305394,"name":"OSV / GitHub Security Advisories","retrievedAt":1793848258555,"url":"https://osv.dev/vulnerability/GHSA-6jxj-px6v-747w"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793848263894,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-61846"}],"ssvc":{"assessedAt":1793845715312,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage","updatedAt":1793848263894}