css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation. This vulnerability is fixed in 2.1.0 and 1.22.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
premailer css_parser affected
Version Status Constraints
>= 2.0.0, < 2.1.0 affected —
< 1.22.0 affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

No data.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-ff6c-w6qf-7xqc CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/premailer/css_parser/commit/35e689c904225add78e0c488cf04bad052666449 cve-icon cve-icon
https://github.com/premailer/css_parser/commit/e0c95d5abe91b237becb90ff316531a6547ada18 cve-icon cve-icon
https://github.com/premailer/css_parser/issues/185 cve-icon cve-icon
https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc cve-icon cve-icon
History

Thu, 14 May 2026 17:00:00 +0000

Type Values Removed Values Added
Description css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation. This vulnerability is fixed in 2.1.0 and 1.22.0.
Title css_parser allows to MITM included https css urls
Weaknesses CWE-295
CWE-829
References
Metrics cvssV3_1

{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-05-14T16:15:04.907Z

Reserved: 2026-05-05T19:00:06.022Z

Link: CVE-2026-44312

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-05-14T17:16:22.393

Modified: 2026-05-14T18:13:33.660

Link: CVE-2026-44312

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-14T18:30:26Z

Weaknesses