Back to overview

CVE-2026-14651

LOW
3.3
CVSS 3.1
Description
A vulnerability has been found in connorskees grass up to 0.13.4. The impacted element is the function grass_compiler::selector::extend/grass_compiler::evaluate::visitor. The manipulation leads to denial of service. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."

Metadata

CVE ID
CVE-2026-14651
State
PUBLISHED
Assigner
VulDB
Reserved
2026-07-03 18:40 UTC
Published
2026-07-04 20:15 UTC
Last updated
2026-07-04 20:15 UTC
Primary CWE
CWE-404
Denial of Service
Vendor / Product
connorskees / grass
Sources
cve.org  ·  NVD

Severity & Metrics

3.3 LOW CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C
Affected products (1)
VendorProductPlatformVersions
connorskees grass — 0.13.0, 0.13.1, 0.13.2, 0.13.3 …
Weakness (CWE)
CWESourceDescription
CWE-404 cna Denial of Service
CVSS scores (4)
ScoreSeverityVersionSourceVector
4.8 MEDIUM 4.0 cna CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
3.3 LOW 3.1 cna CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C
3.3 LOW 3.0 cna CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C
1.7 N/D 2.0 cna AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C
References (6)
Back to overview