Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
CssParser::Parser#readremotefile (and therefore loaduri!, and the @import-following branch of addblock!) issues HTTP/HTTPS requests against any host, port and URI it is handed, with no scheme allowlist, no host / IP filtering, and no protection against link-local, loopback or RFC‑1918 addresses. Location: redirects are followed recursively back into the same function, which also services file:// URIs, so a single attacker-controlled HTTP redirect upgrades the bug from SSRF to arbitrary local file disclosure. In practice, any consumer of cssparser that hands it attacker‑influenced CSS together with a baseuri: option — Premailer being the canonical example — is exposed. The attacker only needs the ability to land one @import url(...) in the CSS that the host application parses. Vulnerable code lib/cssparser/parser.rb#L613-L687: There is no validation of uri.host, uri.scheme, or the resolved IP address — neither before the HTTP request, nor before the recursive call on the…
Recommended action: Upgrade to 3.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFYNONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation. Details In lib/cssparser/parser.rb, the HTTP client sets: https://github.com/premailer/cssparser/blob/3f91e8db7547fac50ab50cb7f9920f785f722740/lib/cssparser/parser.rb#L646 As a result, the library does not validate the authenticity of HTTPS connections and does not protect against man-in-the-middle attacks. Any attacker in a position to intercept network traffic can inject or modify CSS loaded via HTTPS URLs without detection or warning. PoC 1. Set up a test Ruby project that uses the CSS Parser gem and loads an external stylesheet over HTTPS. 2. Use a local proxy (such as mitmproxy or Burp Suite) to intercept outgoing HTTPS requests. 3. Present a fake…
Recommended action: Upgrade to 2.1.0 or 1.22.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.