CVE-2026-53727

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53727
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53727.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53727
Aliases
Downstream
Published
2026-07-17T20:30:37.291Z
Modified
2026-08-20T03:54:27.165515396Z
Severity
  • 8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator
Summary
css_parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`
Details

cssparser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#readremotefile in lib/cssparser/parser.rb, and therefore loaduri! and the @import-following branch of addblock!, issued HTTP and HTTPS requests against any host, port, and URI without a scheme allowlist, host or IP filtering, or protection against link-local, loopback, or RFC-1918 addresses. Location: redirects were followed recursively back into the same function, which also serviced file:// URIs, so a single attacker-controlled HTTP redirect could upgrade the bug from SSRF to arbitrary local file disclosure. Any consumer of cssparser that hands it attacker-influenced CSS together with a baseuri: option is exposed. This issue is fixed in version 3.0.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53727.json",
    "cwe_ids": [
        "CWE-918"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/premailer/css_parser

Affected ranges

Type
GIT
Repo
https://github.com/premailer/css_parser
Events
Introduced
cee10f16b11dd175f17b0e5f6aefa488378e964b
Fixed
7d2ddf0189cd54b54f378f59daefa10cb036e476
Fixed
e0a151458b2a801ae265ba420862ef8b1127b3ae
Fixed
f02be347d3a49d56ef706f5bf68621f20e3a7d40
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:premailer:css_parser:2.2.0:*:*:*:*:ruby:*:*",
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.2.0"
        },
        {
            "last_affected": "2.2.0"
        }
    ]
}

Affected versions

2.*
2.2.0
v2.*
v2.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53727.json"