Executive brief
A denial-of-service vulnerability exists in grass, a Sass compiler used to convert style sheets into CSS. If the compiler processes a specially crafted file containing specific character sequences, it can crash the application or service using the library. This could lead to service interruptions for developers or automated build systems processing untrusted input.
Technical details
A panic-induced denial-of-service vulnerability exists in the grass_compiler::raw_to_parse_error function of the grass Sass compiler. The flaw occurs when the parser encounters a syntax error and attempts to generate a diagnostic message using the codemap crate. If the error span boundary falls inside a multi-byte UTF-8 character, the application attempts to index the string at a non-character boundary, triggering a Rust panic that aborts the process. This affects both the library API (grass::from_string) and the CLI tool. The vulnerability is reachable via local execution by providing malformed SCSS input.
Affected products
- connorskees grass up to 0.13.4
Timeline
- 2026-06-03: disclosed: Issue reported on GitHub repository
- 2026-07-04: advisory: CVE published to NVD