Executive brief
A vulnerability in the 'grass' Sass compiler can allow a local user to cause a denial-of-service condition. By providing a specially crafted, very small SCSS file, an attacker can force the compiler to consume excessive amounts of memory and CPU time. This could lead to system slowdowns or service outages for applications that programmatically compile untrusted Sass/SCSS content.
Technical details
A vulnerability in the grass_compiler::selector::extend and grass_compiler::evaluate::visitor functions leads to improper resource management (CWE-404). When processing specific SCSS patterns involving parent-selector references ('&') combined with adjacent-sibling ('+') or general-sibling ('~') combinators, the compiler recursively materializes a cross-product of combinations. An attacker can provide a small payload (e.g., 85 bytes) that triggers exponential memory allocation (observed up to 2.5 GiB) and high CPU usage. While the maintainer notes that the @extend algorithm is definitionally exponential in Sass, the implementation in grass allows for trivial DoS via sub-100-byte payloads. The attack requires the ability to submit SCSS source code for local compilation.
Affected products
- connorskees grass up to 0.13.4
Timeline
- 2026-06-03: disclosed: Issue reported on GitHub repository
- 2026-07-04: advisory: CVE-2026-14651 published