Read the docs
TI-2026-38747 Aliases CVE-2026-53727GHSA-9pmc-p236-855h

css_parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`

Priority HIGH 72CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_remote_file in lib/css_parser/parser.rb, and therefore load_uri! and the @import-following branch of add_block!, issued HTTP and HTTPS requests against any host, port, and URI without a scheme allowlist, host or IP filtering, or protection against link-local, loopback, or RFC-1918 addresses. Location: redirects were followed recursively back into the same function, which also serviced file:// URIs, so a single attacker-controlled HTTP redirect could upgrade the bug from SSRF to arbitrary local file disclosure. Any consumer of css_parser that hands it attacker-influenced CSS together with a base_uri: option is exposed. This issue is fixed in version 3.0.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00506 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed css_parser (premailer): 3.0.0css_parser (RubyGems): 3.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
premailercss_parserbefore 3.0.03.0.0Patch availableCNA
—css_parser (RubyGems)before 3.0.03.0.0Patch availableGHSA-9pmc-p236-855h
  • css_parser Vendorpremailer Affected before 3.0.0 Fixed in 3.0.0 Patch available CNA
  • css_parser (RubyGems) Vendor— Affected before 3.0.0 Fixed in 3.0.0 Patch available GHSA-9pmc-p236-855h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:premailer:css_parser:2.2.0:*:*:*:*:ruby:*:*2.2.0Vulnerablepremailer
  • cpe:2.3:a:premailer:css_parser:2.2.0:*:*:*:*:ruby:*:* Versions 2.2.0 Vulnerable ·premailer

Remediation

  • Fix · CNA css_parser (premailer) Fixed in 3.0.0
  • Fix · GHSA-9pmc-p236-855h css_parser (RubyGems) Fixed in 3.0.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat 3scale API Management Platform 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53727
  2. 2026-10-03 Alias added: GHSA-9pmc-p236-855h

References

Exploit 1

Patch 2

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences