CVE-2026-14650

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14650
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14650.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14650
Downstream
Published
2026-07-04T20:00:08.823Z
Modified
2026-07-15T01:48:50.194832014Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
connorskees grass UTF-8 Character raw_to_parse_error denial of service
Details

A flaw has been found in connorskees grass up to 0.13.4. The affected element is the function grasscompiler::rawtoparseerror of the component UTF-8 Character Handler. Executing a manipulation can lead to denial of service. The attack is restricted to local execution. The exploit has been published and may be used. In Issue #117 with similar structure the project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."

Database specific 
{
    "cwe_ids": [
        "CWE-404"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14650.json",
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.13.3"
                },
                {
                    "last_affected": "0.13.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/connorskees/grass

Affected ranges

Type
GIT
Repo
https://github.com/connorskees/grass
Events
Introduced
4047c7f7420aa4f9561608c4eb93dcc1bcbf0597
Last affected
e0bb9e2eabfc3a58e42b03089cd7b22c68d09d0b
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.13.0"
        },
        {
            "last_affected": "0.13.0"
        },
        {
            "introduced": "0.13.1"
        },
        {
            "last_affected": "0.13.1"
        },
        {
            "introduced": "0.13.2"
        },
        {
            "last_affected": "0.13.2"
        },
        {
            "introduced": "0.13.4"
        },
        {
            "last_affected": "0.13.4"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.13.0
0.13.1
0.13.2
0.13.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14650.json"