Is CVE-2026-116695 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116695 being exploited in the wild.

How severe is CVE-2026-116695?

Medium severity, with a CVSS score of 4, published 27 October 2026.

Which products and versions are affected?

Ruby Crass before 1.0.8; crass (RubyGems) <= 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.8.

Is there a fix for CVE-2026-116695?

Yes. crass (RubyGems): upgrade to 1.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116695 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116695?

Check whether you run Ruby Crass or crass (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116695: Crass CSS parser bad URL tokenizer bypass in sanitizers

Q: Is there a fix for CVE-2026-116695?

Yes. crass (RubyGems): upgrade to 1.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-116695 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-116695?

Check whether you run Ruby Crass or crass (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116695 · Severity: medium · CVSS 4 · Published 2026-10-27

Crass is a Ruby CSS parser used by sanitizers to clean untrusted stylesheets. A tokenizer bug allows attackers to craft malicious CSS that bypasses the sanitizer, exposing browsers to UI redress attacks, external resource loading, or CSS-based data exfiltration. Although script execution is not possible, the vulnerability can trick browsers into applying CSS that should have been blocked.

Technologies: crass (RubyGems). Vendors: Ruby, RubyGems.

Quick answers

Is CVE-2026-116695 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116695 being exploited in the wild.
How severe is CVE-2026-116695?: Medium severity, with a CVSS score of 4, published 27 October 2026.
Which products and versions are affected?: Ruby Crass before 1.0.8; crass (RubyGems) <= 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.8.
Is there a fix for CVE-2026-116695?: Yes. crass (RubyGems): upgrade to 1.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116695 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116695?: Check whether you run Ruby Crass or crass (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

crass (RubyGems): upgrade to 1.0.8 or later
```
bundle update crass
```

Technical details

The vulnerability is a CSS tokenizer bug where a closing parenthesis following an escaped backslash inside a bad URL token is incorrectly treated as escaped, causing the bad URL token to not terminate when it should according to the CSS Syntax Level 3 specification. This allows Crass to consume more input than a compliant browser, permitting CSS sanitizers built on Crass to pass through declarations, style rules, or at-rules that a browser would then apply. The flaw requires parsing untrusted CSS and reserializing it without rejecting bad URL tokens, making it a concern for CSS sanitization libraries.

Affected products

Ruby Crass before 1.0.8

Identifiers

CVE-2026-116695
GHSA-pq4g-8rxf-4g29

Timeline

2026-10-21: disclosed
2026-10-21: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.