CVE-2026-53727

css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_remote_file in lib/css_parser/parser.rb, and therefore load_uri! and the @import-following branch of add_block!, issued HTTP and HTTPS requests against any host, port, and URI without a scheme allowlist, host or IP filtering, or protection against link-local, loopback, or RFC-1918 addresses. Location: redirects were followed recursively back into the same function, which also serviced file:// URIs, so a single attacker-controlled HTTP redirect could upgrade the bug from SSRF to arbitrary local file disclosure. Any consumer of css_parser that hands it attacker-influenced CSS together with a base_uri: option is exposed. This issue is fixed in version 3.0.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53727.json"
}

References

Affected packages

Git / github.com/premailer/css_parser

Affected ranges

Type

GIT

Repo

https://github.com/premailer/css_parser

Events

Introduced

cee10f16b11dd175f17b0e5f6aefa488378e964b

Fixed

7d2ddf0189cd54b54f378f59daefa10cb036e476

Fixed

e0a151458b2a801ae265ba420862ef8b1127b3ae

Fixed

f02be347d3a49d56ef706f5bf68621f20e3a7d40

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:premailer:css_parser:2.2.0:*:*:*:*:ruby:*:*",
            "range": [
                {
                    "introduced": "2.2.0"
                },
                {
                    "last_affected": "2.2.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "range": [
                {
                    "fixed": "7d2ddf0189cd54b54f378f59daefa10cb036e476"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "e0a151458b2a801ae265ba420862ef8b1127b3ae"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v3.0.0",
            "range": [
                {
                    "fixed": "f02be347d3a49d56ef706f5bf68621f20e3a7d40"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

2.*

2.2.0

v2.*

v2.2.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53727.json"