Vulnerability · CVE-2026-116695
Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
Published Oct 28, 2026 · catalog updated Oct 28, 2026 · Crass: Incorrect tokenization of
Last checked Nov 4, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-116695. EPSS is 0.35%. Act only if a listed version of Crass: Incorrect tokenization of is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Crass: Incorrect tokenization of).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium—
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.35%
- Remediation
- Version ranges on file
- Affected products
- RubyGems crass · gem crass · rubygems crass
## Summary Crass's tokenizer didn't terminate a bad URL token at a that followed an escaped backslash ( ). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing through declarations, style rules, or at-rules (including ) that the sanitizer would otherwise have removed, but that a browser would then parse and apply. ## Details While consuming the remnants of a bad URL (CSS Syntax Level 3, §4.3.15), Crass checked whether the *previously consumed* code point and the next code point formed a valid escape, in addition to checking the next two unconsumed code points. After an escaped backslash, the previously consumed code point is a backslash, so a following was incorrectly treated as escaped and the bad URL token continued until the next unescaped or the end of the input. Browsers terminate the bad URL at that , so everything Crass treated as part of the bad URL is live CSS to a browser. This bug has existed in every released version of Crass. ## Impact Crass by itself only mis-tokenizes input. The security impact is on CSS sanitizers that use Crass to make allow/deny decisions and then re-serialize the CSS. Exploitation requires a sanitizer that doesn't reject bad URL tokens wherever they occur. Confirmed examples (verified in Chromium against the sanitizers' output): - **Sanitize** (all versions through 7.0.0): - In and attributes, a bad URL inside a or block in the value of an allowlisted property can smuggle arbitrary declarations, such as or a URL with a disallowed protocol. - In and elements, a bad URL in a selector can smuggle arbitrary style rules and at-rules, including . - **Loofah** ( , used for attributes), and therefore **rails-html-sanitizer** ( , and when is a permitted attribute): a bad URL inside an allowlisted function such as or can smuggle declarations Loofah normally strips, such as and values. Smuggled CSS can
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- RubyGems crass0 → 1.0.8
- gem crass<1.0.8
- rubygems crass<= 1.0.7
How to fix CVE-2026-116695
Upgrade
CVE-2026-116695 lists a fix boundary at 1.0.8. Compare the installed build with that boundary before you change production.
Version check
Affected <1.0.8
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-116695. EPSS is 0.35%. Act only if a listed version of Crass: Incorrect tokenization of is installed.
Which versions are affected?
Compare what you have installed with 0 → 1.0.8, <1.0.8, <= 1.0.7. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-436. EPSS 0.35%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 28, 2026 · GitHub Advisory Database
Detected
## Summary Crass's tokenizer didn't terminate a bad URL token at a that followed an escaped backslash ( ). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing through declarations, style rules, or at-rules (including ) that the sanitizer would otherwise have
Oct 28, 2026 · GitHub Advisory Database
Fix available
crass fixed in 1.0.8
Oct 28, 2026 · GitHub Advisory Database
Fix available
crass fixed in 1.0.8
Oct 28, 2026 · GitHub Advisory Database
Updated
## Summary Crass's tokenizer didn't terminate a bad URL token at a that followed an escaped backslash ( ). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing through declarations, style rules, or at-rules (including ) that the sanitizer would otherwise have
Sources
- CVE.orgVulnerability recordCVE-2026-116695
Official CVE identifier
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-pq4g-8rxf-4g29
GitHub Advisory Database record mirrored by OSV.
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-116695
Crass's tokenizer didn't terminate a bad URL token at a ) that followed an escaped backslash (\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing through declarations, style rules, or at-rules (including @import) that the sanitizer would otherwise have r
advisories.gitlab.com - GitLab Advisory DatabasePackage advisorygem/crass/CVE-2026-116695.yml
Crass's tokenizer didn't terminate a bad URL token at a that followed + an escaped backslash ( ). As a result, Crass consumed more input as part of + the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted + CSS with Crass and re-emit it could be tricked into passing through declarations, + style rules, or at-rules (including ) that the sanitizer would otherwise + have
gitlab.com - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-pq4g-8rxf-4g29
Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
osv.dev
References
Freshness
Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- GitHub Advisory DatabaseNov 2, 2026
- OpenSSF OSV / OSV ScannerNov 2, 2026
- GitLab Advisory DatabaseOct 30, 2026
- CVE.orgOct 29, 2026
- GitLab Advisory DatabaseOct 29, 2026