Priority LOW 39
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification.
rgrove
Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
rgrove records in CISA KEVNo rgrove vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
9 records
TI-2020-03543 CVE-2020-4054 · GHSA-p4x4-rw2p-8j8m
Cross-site Scripting in Sanitize
Priority LOW 36
In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability.
TI-2018-02737 CVE-2018-3740 · GHSA-7f42-p84j-f58p
Cross-site scripting in Ryan Grove sanitize
Priority LOW 36
A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element.
Priority LOW 35
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification.
TI-2023-18617 CVE-2023-36823 · GHSA-f5ww-cq3m-q3g7
Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content
Priority LOW 32
Sanitize is an allowlist-based HTML and CSS sanitizer.
Priority LOW 29
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification.
Priority LOW 29
Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification.
TI-2023-09456 CVE-2023-23627 · GHSA-fw3g-2h3j-qmm7
Sanitize vulnerable to Cross-site Scripting via Improper neutralization of `noscript` element
Priority LOW 28
Sanitize is an allowlist-based HTML and CSS sanitizer.
TI-2026-81530 CVE-2026-116695 · GHSA-pq4g-8rxf-4g29
Incorrect bad URL tokenization in Crass enables CSS sanitizer bypass
Priority LOW 24
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification.