crass vulnerabilities
CVEs whose affected-version data names the crass package (rubygems). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-116695Medium· 5.3Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
▾ Sunlitcrass · crassEPSS 0.35%via GHSA
CVE-2026-61845HighCrass : Large numeric exponents cause CPU and memory denial of service
Crass : Large numeric exponents cause CPU and memory denial of service
▾ Twilightcrass · crassvia GHSA