A flaw in the selector extend routine and visitor evaluation of the connorskees grass Sass compiler (CWE-404, CWE-835) can cause the compilation to grow exponentially and exhaust system resources. An attacker with local access can supply a crafted stylesheet that forces the compiler into an infinite processing loop, leading to high CPU usage and memory usage until the process terminates or the system becomes unresponsive. The vulnerability solely impacts availability; it does not grant code execution or data disclosure.

All releases of connorskees grass up to and including version 0.13.4 are affected, as the compiler's extend/visitor logic is present in those builds. Applications that invoke the compiler on-the-fly stylesheet generation, build pipelines or developer workstations—must verify the version they are running. Versions newer than 0.13.4 are not listed as vulnerable, implying that the issue has been addressed in subsequent releases.

The CVSS score of 4.8 indicates moderate severity. The EPSS score low likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Because the attack requires local access to supply the malicious stylesheet, mitigation can be applied through controlled input handling and by limiting who can invoke the compiler on the affected host.