This vulnerability in connorskees grass (versions 0.13.0 through 0.13.4) involves the grass_compiler::raw_to_parse_error function within the UTF-8 Character Handler component. A local attacker with low privileges can trigger a denial of service condition by exploiting the way the compiler handles certain inputs, leading to excessive compile time or resource exhaustion. The project maintainer notes that such denial of service conditions are typical in Sass compilers due to recursive functions and nested mixins, and that the exponential time complexity of the @extend algorithm is expected behavior rather than a flaw. No official remediation or patch has been provided as of the publication date.

The impact is a denial of service condition caused by resource exhaustion during compilation, which can be triggered by a local attacker with limited privileges. There is no indication of remote exploitation or privilege escalation. The vulnerability does not compromise confidentiality, integrity, or availability beyond local denial of service. The CVSS 4.8 score reflects a medium severity with local attack vector and low privileges required.

No official patch or remediation is currently available. The project maintainer considers this behavior expected and not a critical vulnerability. Users should be aware of the potential for denial of service from complex or maliciously crafted inputs when running the compiler locally. Monitoring and limiting local user access to the compiler may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.