Skip to content
Threat Feed
Subscribe

Vendor

Premailer

1 brief RSS
medium advisory

Ruby CSS Parser Vulnerable to SSRF and Local File Disclosure via `read_remote_file`

The `css_parser` library, specifically in versions up to and including 2.2.0, is vulnerable to Server-Side Request Forgery (SSRF) and local file disclosure through improper URI validation in the `CssParser::Parser#read_remote_file` method, allowing attackers to access internal network resources or read local files when processing attacker-controlled CSS.

css_parser <= 2.2.0 ssrf lfi supply-chain ruby vulnerability web-application
4t