Threats tagged 'ghsa-6jxj-px6v-747w'

Crass versions prior to 1.0.7 contain a vulnerability where deeply nested CSS blocks and functions can cause unbounded recursion, leading to a SystemStackError or excessive memory consumption. This issue arises because Crass lacks a depth guard when parsing CSS simple blocks and functions. The vulnerability is fixed in version 1.0.7 by introducing a configurable depth limit with a conservative default.