Medium severity5.8GHSA Advisory· Published May 14, 2026· Updated May 15, 2026

CVE-2026-44312

Description

css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation. This vulnerability is fixed in 2.1.0 and 1.22.0.

Affected products

Premailer/Css ParserGHSA
Range: < 2.1.0

Patches

35e689c90422

Merge pull request #186 from premailer/grosser/https

https://github.com/premailer/css_parserMichael GrosserApr 28, 2026via ghsa

commit

1 file changed · +0 −1

lib/css_parser/parser.rb+0 −1 modified

@@ -643,7 +643,6 @@ def read_remote_file(uri) # :nodoc:
             uri.port = 443 unless uri.port
             http = Net::HTTP.new(uri.host, uri.port)
             http.use_ssl = true
-            http.verify_mode = OpenSSL::SSL::VERIFY_NONE
           else
             http = Net::HTTP.new(uri.host, uri.port)
           end

e0c95d5abe91