CVE-2026-44312

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

5.8 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N                                    

Vulnerability Description

css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation. This vulnerability is fixed in 2.1.0 and 1.22.0.

Vulnerability Details

Published Date

May 07, 2026

Last Modified

May 15, 2026

CWE ID

CWE-295

Source

GitHub

Vendor

rubygems

Product

css_parser

External References

https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc
https://github.com/premailer/css_parser/issues/185
https://github.com/advisories/GHSA-ff6c-w6qf-7xqc

CVE-2026-44312

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment