Threats affecting pkg:gem/crass

Crass, a Ruby CSS parser, has a vulnerability prior to version 1.0.8 where it incorrectly treats a closing parenthesis after an escaped backslash as escaped when parsing bad URLs. This causes Crass to retain CSS declarations inside a bad URL token that browsers would normally treat as live CSS. This can allow CSS-based UI redress, external resource loading, or data exfiltration when sanitizing untrusted CSS, but it does not enable script execution in modern browsers. The issue is fixed in version 1.0.8.

Crass versions prior to 1.0.7 contain a vulnerability where processing CSS scientific notation numbers with very large exponents can cause excessive CPU and memory consumption, potentially leading to denial of service or application crashes. This occurs because Crass converts these numbers with unbounded exponentiation before clamping to Float::MAX. The issue is fixed in version 1.0.7.