Description
A flaw has been found in connorskees grass up to 0.13.4. The affected element is the function grass_compiler::raw_to_parse_error of the component UTF-8 Character Handler. Executing a manipulation can lead to denial of service. The attack is restricted to local execution. The exploit has been published and may be used. In Issue #117 with similar structure the project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."
Published: 2026-07-04
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

connorskees grass contains an unchecked error condition in its UTF‑8 Character Handler, specifically the grass_compiler::raw_to_parse_error function. Malformed UTF‑8 input triggers an error that causes the compiler to terminate prematurely, resulting in a service crash and a denial of service. The flaw does not affect confidentiality or integrity and is limited to the local execution context.

Affected Systems

connorskees Grass releases up to and including version 0.13.4 are affected. Any installation that exposes the grass compiler to local input is vulnerable; newer releases are not impacted by this specific issue.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of <1% suggests a very low probability of exploitation. The vulnerability is limited to local code execution or the ability to supply crafted input on the host, so remote attackers are not directly affected. An exploit has been published, but the issue is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on July 26, 2026 at 21:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade connorskees grass to a version newer than 0.13.4 to remove the unchecked error condition.
  • If an upgrade cannot be performed immediately, restrict access to the grass compiler so it accepts input only from trusted users or processes, preventing untrusted data from reaching it.
  • Enable monitoring of grass service logs to detect repeated crashes caused by raw_to_parse_error and set alerts to trigger investigation and remediation.

Generated by OpenCVE AI on July 26, 2026 at 21:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1050
References
Metrics threat_severity

None

 threat_severity

Low

Sat, 04 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
Description A flaw has been found in connorskees grass up to 0.13.4. The affected element is the function grass_compiler::raw_to_parse_error of the component UTF-8 Character Handler. Executing a manipulation can lead to denial of service. The attack is restricted to local execution. The exploit has been published and may be used. In Issue #117 with similar structure the project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."
Title connorskees grass UTF-8 Character raw_to_parse_error denial of service
First Time appeared Connorskees
Connorskees grass
Weaknesses CWE-404
CPEs cpe:2.3:a:connorskees:grass:*:*:*:*:*:*:*:*
Vendors & Products Connorskees
Connorskees grass
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Connorskees Grass
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T16:51:14.200Z

Reserved: 2026-07-03T18:40:38.396Z

Link: CVE-2026-14650

cve-icon Vulnrichment

Updated: 2026-07-06T16:36:17.810Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-04T20:00:08Z

Links: CVE-2026-14650 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T21:45:05Z

Weaknesses
  • CWE-1050

    Excessive Platform Resource Consumption within a Loop

  • CWE-404

    Improper Resource Shutdown or Release