CVE-2026-93752 in CSSOM
Summary
by MITRE • 09/18/2026
CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property names. Attackers can supply a stylesheet with a declaration named length to replace the internal counter and trigger excessive memory allocation during cssText serialization, causing process termination.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The Common Style Sheet Object Model library version 0.5.0 contains a critical denial of service vulnerability within its CSSStyleDeclaration implementation, specifically affecting the setProperty method. This flaw stems from an insufficient validation mechanism for property names assigned to style declarations. The underlying issue arises because the library fails to distinguish between standard CSS properties and internal JavaScript object attributes that share similar naming conventions or are reserved by the runtime environment. When a developer or automated process invokes setProperty with a key such as length, the system does not reject this input based on security policies but instead treats it as a valid property assignment. This lack of boundary checking allows external inputs to overwrite critical internal state variables managed by the library's serialization engine.
The technical exploitation vector involves supplying a malicious stylesheet or style object that includes a declaration with the name length. In many JavaScript environments, particularly those involving array-like objects or string buffers used for text processing, the property named length often dictates memory allocation sizes or iteration counts during serialization processes. By setting this internal counter to an excessively large value through the setProperty method, an attacker effectively manipulates the library's expectation of data size. When the system subsequently attempts to serialize these styles into a CSSOM string representation via cssText, it allocates memory proportional to the manipulated length property rather than the actual content size. This discrepancy triggers excessive memory allocation that quickly exhausts available heap space or exceeds process limits.
The operational impact of this vulnerability is severe, resulting in an application-level denial of service condition. As the memory consumption spikes uncontrollably during the serialization phase, the hosting environment typically responds by terminating the offending process to prevent system-wide instability. For web applications relying on CSSOM manipulation for dynamic styling or server-side rendering, this can lead to immediate crashes and unavailability of services. Since the vulnerability is triggered through standard API calls that are often used in legitimate development workflows, it poses a significant risk if user-controlled data flows into style declaration objects without proper sanitization. The attack does not require code execution privileges but merely access to the CSSOM manipulation functions, making it accessible to any actor capable of injecting malicious stylesheets or triggering specific rendering paths within an application.
Mitigation strategies must focus on strict input validation and defensive programming practices at the point where style properties are set. Developers should implement a whitelist approach for allowed property names in custom wrappers around the setProperty method, ensuring that only standard CSS identifiers are permitted while blocking reserved JavaScript attributes like length, constructor, or prototype. Additionally, integrating static analysis tools configured to detect unsafe assignments to known sensitive properties can help identify vulnerable code paths during development. Updating to patched versions of the library where this validation is enforced by default is the most effective long-term solution. Until such updates are available, runtime monitoring and memory usage limits should be applied to contain potential resource exhaustion events before they cause process termination. This vulnerability aligns with CWE-20 Improper Input Validation as it involves failing to verify that user-supplied input meets expected criteria for property names. It also relates to ATT&CK technique T1496 Resource Hijacking, specifically through denial of service via resource consumption, highlighting the importance of securing internal object states against manipulation by external inputs.