Executive brief
The CSS Parser library, used by Ruby applications to process web stylesheets, fails to verify the identity of servers when downloading files over secure HTTPS connections. This allows an attacker positioned on the network to intercept the connection and inject malicious styling content into the application. Such an attack could be used to alter the appearance of generated documents or emails, potentially misleading users or capturing sensitive information through visual manipulation.
Technical details
The CSS Parser gem (RubyGems) contains a vulnerability where HTTPS connections are established using 'OpenSSL::SSL::VERIFY_NONE' in 'lib/css_parser/parser.rb'. This root cause results in a failure to validate the authenticity of remote servers, making the library susceptible to Man-in-the-Middle (MITM) attacks. A network-positioned attacker can present a self-signed or otherwise untrusted certificate to intercept traffic and inject arbitrary CSS into the application's parser. This issue is patched in versions 1.22.0 and 2.1.0.
Affected products
- premailer css_parser >= 2.0.0, < 2.1.0; < 1.22.0
Timeline
- 2026-05-01: disclosed
- 2026-05-07: advisory: GitHub Advisory published
- 2026-05-14: other: NVD published