{"id":"CVE-2026-44312","state":"PUBLISHED","title":"css_parser allows to MITM included https css urls","description":"css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation. This vulnerability is fixed in 2.1.0 and 1.22.0.","publishedAt":"2026-05-14T16:15:04.907Z","updatedAt":"2026-05-15T18:05:54.862Z","severity":{"score":5.8,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["premailer css_parser"],"affected":[{"vendor":"premailer","product":"css_parser","versions":[{"version":">= 2.0.0, < 2.1.0","status":"affected"},{"version":"< 1.22.0","status":"affected"}]}],"references":["https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc","https://github.com/premailer/css_parser/issues/185","https://github.com/premailer/css_parser/commit/35e689c904225add78e0c488cf04bad052666449","https://github.com/premailer/css_parser/commit/e0c95d5abe91b237becb90ff316531a6547ada18"],"weaknesses":["CWE-829","CWE-295"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/44xxx/CVE-2026-44312.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-44312","state":"PUBLISHED","datePublished":"2026-05-14T16:15:04.907Z","dateUpdated":"2026-05-15T18:05:54.862Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-05-05T19:00:06.022Z"},"containers":{"cna":{"title":"css_parser allows to MITM included https css urls","descriptions":[{"lang":"en","value":"css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation. This vulnerability is fixed in 2.1.0 and 1.22.0."}],"affected":[{"vendor":"premailer","product":"css_parser","versions":[{"version":">= 2.0.0, < 2.1.0","status":"affected"},{"version":"< 1.22.0","status":"affected"}]}],"references":[{"url":"https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc","name":"https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/premailer/css_parser/issues/185","name":"https://github.com/premailer/css_parser/issues/185","tags":["x_refsource_MISC"]},{"url":"https://github.com/premailer/css_parser/commit/35e689c904225add78e0c488cf04bad052666449","name":"https://github.com/premailer/css_parser/commit/35e689c904225add78e0c488cf04bad052666449","tags":["x_refsource_MISC"]},{"url":"https://github.com/premailer/css_parser/commit/e0c95d5abe91b237becb90ff316531a6547ada18","name":"https://github.com/premailer/css_parser/commit/e0c95d5abe91b237becb90ff316531a6547ada18","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-829","lang":"en","description":"CWE-829: Inclusion of Functionality from Untrusted Control Sphere","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-295","lang":"en","description":"CWE-295: Improper Certificate Validation","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-05-14T16:15:04.907Z"},"source":{"advisory":"GHSA-ff6c-w6qf-7xqc","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-15T18:05:24.647346Z","id":"CVE-2026-44312","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-15T18:05:54.862Z"}}]}}}