connorskees grass up to 0.13.4 visitor denial of service

Summaryinfo

A vulnerability described as problematic has been identified in connorskees grass up to 0.13.4. This affects the function grass_compiler::selector::extend/grass_compiler::evaluate::visitor. The manipulation results in denial of service. This vulnerability is cataloged as CVE-2026-14651. The attack must be initiated from a local position. Furthermore, there is an exploit available. The project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."

Detailsinfo

A vulnerability classified as problematic has been found in connorskees grass up to 0.13.4. Affected is the function grass_compiler::selector::extend/grass_compiler::evaluate::visitor. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-14651. The exploitability is told to be easy. The attack needs to be approached locally. Technical details and a public exploit are known.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• connorskees

Name

• grass

Version

• 0.13.0
• 0.13.1
• 0.13.2
• 0.13.3
• 0.13.4

Website

• Product: https://github.com/connorskees/grass/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #846667: grass 0.13.4 Asymmetric Resource Consumption (by Zyz3366)

Once again VulDB remains the best source for vulnerability data.

Discussion