PT-2026-38404 · Rubygems · Css Parser

Jlleitschuh · Published 2026-05-07 · Updated 2026-05-14 · CVE-2026-44312

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions css parser versions prior to 1.22.0 css parser versions prior to 2.1.0

Description The software fails to validate HTTPS connections when loading stylesheets, which allows a Man-in-the-Middle (MITM) attacker to inject or modify CSS content. This occurs because the connection is established using OpenSSL::SSL::VERIFY NONE, causing the system to accept any HTTPS certificate, including untrusted ones, without validation. The issue is located in the http.verify mode setting within the lib/css parser/parser.rb file.

Recommendations Update to version 1.22.0. Update to version 2.1.0.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

CWE-829

Related Identifiers

CVE-2026-44312

GHSA-FF6C-W6QF-7XQC

Affected Products

Css Parser

References · 13

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/css_parser/CVE-2026-44312.yml · Exploit
• 🔥 https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc · Exploit
• https://osv.dev/vulnerability/GHSA-ff6c-w6qf-7xqc · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-44312 · Security Note
• https://ubuntu.com/security/CVE-2026-44312 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44312 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-44312 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44312 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-44312 · Vendor Advisory
• https://github.com/premailer/css_parser/issues/185 · Note
• https://github.com/premailer/css_parser/commit/35e689c904225add78e0c488cf04bad052666449 · Note
• https://github.com/premailer/css_parser/commit/e0c95d5abe91b237becb90ff316531a6547ada18 · Note
• https://github.com/premailer/css_parser · Note