CVE-2026-14651

Name of the Vulnerable Software and Affected Versions connorskees grass versions prior to 0.13.5

Description A local manipulation of the grass compiler::selector::extend/grass compiler::evaluate::visitor function can lead to a denial of service. This occurs because the @extend algorithm is definitionally exponential, meaning the time required to compile the input does not increase linearly.

Recommendations Update to a version newer than 0.13.4.