rubygem-crass is a Ruby CSS parser compliant with CSS Syntax Level 3. Multiple vulnerabilities affect versions prior to 1.0.8, including improper handling of bad URLs that can allow CSS-based UI redress or data exfiltration without script execution, and denial-of-service conditions caused by recursive parsing of deeply nested blocks, excessive adjacent comments, or inefficient handling of non-ASCII characters. These issues are fixed in versions 1.0.7 and 1.0.8.