This vulnerability in connorskees grass up to version 0.13.4 involves denial of service caused by the manipulation of the grass_compiler::selector::extend and grass_compiler::evaluate::visitor functions. The attack must be performed locally and results in excessive compile time rather than a crash or memory corruption. The maintainer clarifies that the exponential compile time behavior is inherent to the @extend algorithm and recursive Sass constructs, suggesting the reported DoS is a known and accepted limitation rather than a traditional flaw.

The impact is a denial of service condition through resource exhaustion caused by exponential compile time in the Sass compiler. This can degrade or halt local compilation processes but does not lead to privilege escalation, data corruption, or remote exploitation. The attack requires local access and does not affect confidentiality or integrity.

No official fix or patch is currently available. The project maintainer indicates that the observed behavior is expected and not considered a traditional vulnerability. Users should be aware of the potential for high compile times with complex or recursive Sass constructs involving @extend. Monitoring and limiting local input complexity may help mitigate impact. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.