CVE-2026-44312

Name of the Vulnerable Software and Affected Versions css parser versions prior to 1.22.0 css parser versions prior to 2.1.0

Description The software fails to validate HTTPS connections when loading stylesheets, which allows a Man-in-the-Middle (MITM) attacker to inject or modify CSS content. This occurs because the connection is established using OpenSSL::SSL::VERIFY NONE, causing the system to accept any HTTPS certificate, including untrusted ones, without validation. The issue is located in the http.verify mode setting within the lib/css parser/parser.rb file.

Recommendations Update to version 1.22.0. Update to version 2.1.0.