Skip to content
OpenAdvisories

Vendor

rgrove

8 known vulnerabilities.

Products

crass 5 sanitize 3
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.9
    CVE-2026-61845

    Crass: Large numeric exponents cause CPU and memory denial of service

    Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific notation` number values with unbounded exponentiation before clamping the result to `Float::MAX`. Applications that use…

    rgrove crass ruby-crass crass Debian Ubuntu RubyGems
  • High 7.1
    CVE-2023-36823

    Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content

    Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-…

    rgrove sanitize sanitize ruby-sanitize Debian Ubuntu RubyGems
  • High 7.3
    CVE-2020-4054

    Cross-site Scripting in Sanitize

    In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's "relaxed" config, or a custom config that allows certain elements, some content in a math…

    rgrove sanitize ruby-sanitize sanitize Debian Ubuntu RubyGems