How severe is CVE-2026-116695?

No CVSS score has been assigned to CVE-2026-116695 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by CVE-2026-116695?

CVE-2026-116695 affects the following packages: crass (RubyGems). Ecosystems affected: RubyGems.

How do I fix CVE-2026-116695?

Update crass to 1.0.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-116695 is resolved across your whole dependency graph.

How do I detect CVE-2026-116695 in my RubyGems dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for crass, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2026-116695 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Is CVE-2026-116695 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-116695 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2026-116695?

CVE-2026-116695 has an EPSS (Exploit Prediction Scoring System) score of 0.4%, placing it in the 29th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2026-116695?

CVE-2026-116695 is classified as CWE-436 (CWE-436). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2026-116695 published, and has it been updated?

CVE-2026-116695 was published on October 27, 2026 and was last updated on October 28, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

💎 RubyGems

Not in CISA KEV

CVE-2026-116695 — crass

Fix: rgrove/crass@689fc45

CVE-2026-116695 is a CWE-436 vulnerability in crass. A fix is available for crass — see the affected versions and patch details below.

Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

Also known asGHSA-pq4g-8rxf-4g29

Published

Oct 27, 2026

Updated

Oct 28, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Oct 28, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗

0.4%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs29th percentile — riskier than 29% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

1 pkg affected

💎crass

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Crass's tokenizer didn't terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing through declarations, style rules, or at-rules (including @import) that the sanitizer would otherwise have removed, but that a browser would then parse and apply.

Details

While consuming the remnants of a bad URL (CSS Syntax Level 3, §4.3.15), Crass checked whether the previously consumed code point and the next code point formed a valid escape, in addition to checking the next two unconsumed code points. After an escaped backslash, the previously consumed code point is a backslash, so a following ) was incorrectly treated as escaped and the bad URL token continued until the next unescaped ) or the end of the input.

Browsers terminate the bad URL at that ), so everything Crass treated as part of the bad URL is live CSS to a browser.

This bug has existed in every released version of Crass.

Impact

Crass by itself only mis-tokenizes input. The security impact is on CSS sanitizers that use Crass to make allow/deny decisions and then re-serialize the CSS. Exploitation requires a sanitizer that doesn't reject bad URL tokens wherever they occur. Confirmed examples (verified in Chromium against the sanitizers' output):

Sanitize (all versions through 7.0.0):
- In Sanitize::CSS.properties and style attributes, a bad URL inside a [...] or (...) block in the value of an allowlisted property can smuggle arbitrary declarations, such as position: fixed or a background-image URL with a disallowed protocol.
- In Sanitize::CSS.stylesheet and <style> elements, a bad URL in a selector can smuggle arbitrary style rules and at-rules, including @import.
Loofah (Loofah::HTML5::Scrub.scrub_css, used for style attributes), and therefore rails-html-sanitizer (sanitize_css, and sanitize when style is a permitted attribute): a bad URL inside an allowlisted function such as calc() or rgb() can smuggle declarations Loofah normally strips, such as position: fixed and url() values.

Smuggled CSS can be used for UI redress (clickjacking or phishing overlays), loading attacker-controlled external resources, and, where rules or @import can be smuggled, CSS-based data exfiltration. This vulnerability doesn't allow script execution in modern browsers.

Patches

Fixed in Crass 1.0.8. Users of Sanitize, Loofah, rails-html-sanitizer, or any other library that uses Crass to sanitize CSS should upgrade Crass to 1.0.8 or later.

Workarounds

There are no practical workarounds other than upgrading. Rejecting any CSS input that contains the character sequence \\ would block the known trigger, but this is a blunt measure and may reject legitimate CSS.

References

CSS Syntax Module Level 3, "Consume the remnants of a bad url": https://drafts.csswg.org/css-syntax-3/#consume-remnants-of-bad-url

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
💎RubyGems	`crass`	all versions	1.0.8`bundle update crass --conservative`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for crass, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update crass to 1.0.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-116695 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

## Summary Crass's tokenizer didn't terminate a bad URL token at a `)` that followed an escaped backslash (`\\`). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked into passing through declarations, style rules, or at-rules (including `@import`) that the sanitizer would otherwise have removed, but that a browser would then parse and apply. ## Details While consuming the remnants of a bad URL (CSS Syntax Level 3, §4.3.15), Crass checked whether the *previously co

O3 Security · Impact-Aware SCA

Is CVE-2026-116695 in your dependencies?

Find it across RubyGems, including transitive dependencies.

Scan my dependencies How O3 SCA works