Crass: A large number of adjacent CSS comments can trigger a SystemStackError
GHSA-wwpr-jff3-395c · CVE-2026-61847
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
When the :preserve_comments option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a SystemStackError.
Patches
This is fixed in Crass 1.0.7, which no longer recurses when discarding comments.
Workarounds
Set the :preserve_comments option to true if this is acceptable to your use case (recursion doesn't occur when comments are preserved).
Ready to move
Start Securing
Free, no credit card | First findings in minutes