CVE-2026-53727

Name of the Vulnerable Software and Affected Versions css parser versions prior to 3.0.0

Description An issue exists in the CssParser::Parser#read remote file function and related code paths, such as Parser#load uri! and Parser#add block!, where the software automatically follows @import URLs without adequate scheme or network-range filtering. This allows an attacker to perform Server-Side Request Forgery (SSRF) by supplying crafted CSS that forces the server to make outbound requests to private, loopback, or link-local targets.

Furthermore, the software follows Location: redirects recursively without validating the new scheme, allowing an attacker to redirect an HTTP request to a file:// URI. This elevates the issue to arbitrary local file disclosure, enabling the reading of sensitive files (such as configuration files in block-style DSLs) if the content fits the CSS grammar. Additionally, the hardcoded use of Accept-Encoding: gzip without response size limits makes the system susceptible to decompression bombs, leading to potential Denial of Service (DoS).

Recommendations Upgrade to version 3.0.0. As a temporary mitigation, restrict the use of the base uri: option in Parser#add block! and avoid passing untrusted URIs to Parser#load uri!.