CVE-2026-61847: Crass: A large number of adjacent CSS comments can trigger a SystemStackError

October 29, 2026

When the :preserve_comments option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError.

References

github.com/advisories/GHSA-wwpr-jff3-395c
github.com/rgrove/crass/commit/25d78cc607c54262e9d43ea1930f3ba5bb03dfb5
github.com/rgrove/crass/releases/tag/v1.0.7
github.com/rgrove/crass/security/advisories/GHSA-wwpr-jff3-395c
nvd.nist.gov/vuln/detail/CVE-2026-61847

Code Behaviors & Features

Detect and mitigate CVE-2026-61847 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →