css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation. This vulnerability is fixed in 2.1.0 and 1.22.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|
References
History
Thu, 14 May 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation. This vulnerability is fixed in 2.1.0 and 1.22.0. | |
| Title | css_parser allows to MITM included https css urls | |
| Weaknesses | CWE-295 CWE-829 |
|
| References |
|
|
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-05-14T16:15:04.907Z
Reserved: 2026-05-05T19:00:06.022Z
Link: CVE-2026-44312
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-05-14T17:16:22.393
Modified: 2026-05-14T18:13:33.660
Link: CVE-2026-44312
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-05-14T18:30:26Z