Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by connorskees
CVE-2026-14651 (GCVE-0-2026-14651)
Vulnerability from nvd – Published: 2026-07-04 20:15 – Updated: 2026-07-06 16:23
VLAI
Title
connorskees grass visitor denial of service
Summary
A vulnerability has been found in connorskees grass up to 0.13.4. The impacted element is the function grass_compiler::selector::extend/grass_compiler::evaluate::visitor. The manipulation leads to denial of service. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-404 - Denial of Service
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/376164 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/376164/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-14651 | third-party-advisory |
| https://vuldb.com/submit/846667 | third-party-advisory |
| https://github.com/connorskees/grass/issues/117 | exploitissue-tracking |
| https://github.com/connorskees/grass/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| connorskees | grass |
Affected:
0.13.0
Affected: 0.13.1 Affected: 0.13.2 Affected: 0.13.3 Affected: 0.13.4 cpe:2.3:a:connorskees:grass:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14651",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-06T16:23:16.892795Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-06T16:23:26.884Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:connorskees:grass:*:*:*:*:*:*:*:*"
],
"product": "grass",
"vendor": "connorskees",
"versions": [
{
"status": "affected",
"version": "0.13.0"
},
{
"status": "affected",
"version": "0.13.1"
},
{
"status": "affected",
"version": "0.13.2"
},
{
"status": "affected",
"version": "0.13.3"
},
{
"status": "affected",
"version": "0.13.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zyz3366 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in connorskees grass up to 0.13.4. The impacted element is the function grass_compiler::selector::extend/grass_compiler::evaluate::visitor. The manipulation leads to denial of service. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The project maintainer explains: \"DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T20:15:13.522Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-376164 | connorskees grass visitor denial of service",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/376164"
},
{
"name": "VDB-376164 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/376164/cti"
},
{
"name": "CVE-2026-14651 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-14651"
},
{
"name": "Submit #846667 | grass 0.13.4 Asymmetric Resource Consumption",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/846667"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/connorskees/grass/issues/117"
},
{
"tags": [
"product"
],
"url": "https://github.com/connorskees/grass/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-03T20:45:50.000Z",
"value": "VulDB entry last update"
}
],
"title": "connorskees grass visitor denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-14651",
"datePublished": "2026-07-04T20:15:13.522Z",
"dateReserved": "2026-07-03T18:40:42.488Z",
"dateUpdated": "2026-07-06T16:23:26.884Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14650 (GCVE-0-2026-14650)
Vulnerability from nvd – Published: 2026-07-04 20:00 – Updated: 2026-07-06 16:51
VLAI
Title
connorskees grass UTF-8 Character raw_to_parse_error denial of service
Summary
A flaw has been found in connorskees grass up to 0.13.4. The affected element is the function grass_compiler::raw_to_parse_error of the component UTF-8 Character Handler. Executing a manipulation can lead to denial of service. The attack is restricted to local execution. The exploit has been published and may be used. In Issue #117 with similar structure the project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-404 - Denial of Service
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/376163 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/376163/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-14650 | third-party-advisory |
| https://vuldb.com/submit/846665 | third-party-advisory |
| https://github.com/connorskees/grass/issues/116 | exploitissue-tracking |
| https://github.com/connorskees/grass/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| connorskees | grass |
Affected:
0.13.0
Affected: 0.13.1 Affected: 0.13.2 Affected: 0.13.3 Affected: 0.13.4 cpe:2.3:a:connorskees:grass:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14650",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-06T16:36:16.479783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-06T16:51:14.200Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:connorskees:grass:*:*:*:*:*:*:*:*"
],
"modules": [
"UTF-8 Character Handler"
],
"product": "grass",
"vendor": "connorskees",
"versions": [
{
"status": "affected",
"version": "0.13.0"
},
{
"status": "affected",
"version": "0.13.1"
},
{
"status": "affected",
"version": "0.13.2"
},
{
"status": "affected",
"version": "0.13.3"
},
{
"status": "affected",
"version": "0.13.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zyz3366 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in connorskees grass up to 0.13.4. The affected element is the function grass_compiler::raw_to_parse_error of the component UTF-8 Character Handler. Executing a manipulation can lead to denial of service. The attack is restricted to local execution. The exploit has been published and may be used. In Issue #117 with similar structure the project maintainer explains: \"DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T20:00:08.823Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-376163 | connorskees grass UTF-8 Character raw_to_parse_error denial of service",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/376163"
},
{
"name": "VDB-376163 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/376163/cti"
},
{
"name": "CVE-2026-14650 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-14650"
},
{
"name": "Submit #846665 | grass 0.13.4 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/846665"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/connorskees/grass/issues/116"
},
{
"tags": [
"product"
],
"url": "https://github.com/connorskees/grass/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-03T20:45:47.000Z",
"value": "VulDB entry last update"
}
],
"title": "connorskees grass UTF-8 Character raw_to_parse_error denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-14650",
"datePublished": "2026-07-04T20:00:08.823Z",
"dateReserved": "2026-07-03T18:40:38.396Z",
"dateUpdated": "2026-07-06T16:51:14.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14651 (GCVE-0-2026-14651)
Vulnerability from cvelistv5 – Published: 2026-07-04 20:15 – Updated: 2026-07-06 16:23
VLAI
Title
connorskees grass visitor denial of service
Summary
A vulnerability has been found in connorskees grass up to 0.13.4. The impacted element is the function grass_compiler::selector::extend/grass_compiler::evaluate::visitor. The manipulation leads to denial of service. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-404 - Denial of Service
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/376164 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/376164/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-14651 | third-party-advisory |
| https://vuldb.com/submit/846667 | third-party-advisory |
| https://github.com/connorskees/grass/issues/117 | exploitissue-tracking |
| https://github.com/connorskees/grass/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| connorskees | grass |
Affected:
0.13.0
Affected: 0.13.1 Affected: 0.13.2 Affected: 0.13.3 Affected: 0.13.4 cpe:2.3:a:connorskees:grass:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14651",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-06T16:23:16.892795Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-06T16:23:26.884Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:connorskees:grass:*:*:*:*:*:*:*:*"
],
"product": "grass",
"vendor": "connorskees",
"versions": [
{
"status": "affected",
"version": "0.13.0"
},
{
"status": "affected",
"version": "0.13.1"
},
{
"status": "affected",
"version": "0.13.2"
},
{
"status": "affected",
"version": "0.13.3"
},
{
"status": "affected",
"version": "0.13.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zyz3366 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in connorskees grass up to 0.13.4. The impacted element is the function grass_compiler::selector::extend/grass_compiler::evaluate::visitor. The manipulation leads to denial of service. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The project maintainer explains: \"DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T20:15:13.522Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-376164 | connorskees grass visitor denial of service",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/376164"
},
{
"name": "VDB-376164 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/376164/cti"
},
{
"name": "CVE-2026-14651 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-14651"
},
{
"name": "Submit #846667 | grass 0.13.4 Asymmetric Resource Consumption",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/846667"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/connorskees/grass/issues/117"
},
{
"tags": [
"product"
],
"url": "https://github.com/connorskees/grass/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-03T20:45:50.000Z",
"value": "VulDB entry last update"
}
],
"title": "connorskees grass visitor denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-14651",
"datePublished": "2026-07-04T20:15:13.522Z",
"dateReserved": "2026-07-03T18:40:42.488Z",
"dateUpdated": "2026-07-06T16:23:26.884Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14650 (GCVE-0-2026-14650)
Vulnerability from cvelistv5 – Published: 2026-07-04 20:00 – Updated: 2026-07-06 16:51
VLAI
Title
connorskees grass UTF-8 Character raw_to_parse_error denial of service
Summary
A flaw has been found in connorskees grass up to 0.13.4. The affected element is the function grass_compiler::raw_to_parse_error of the component UTF-8 Character Handler. Executing a manipulation can lead to denial of service. The attack is restricted to local execution. The exploit has been published and may be used. In Issue #117 with similar structure the project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-404 - Denial of Service
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/376163 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/376163/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-14650 | third-party-advisory |
| https://vuldb.com/submit/846665 | third-party-advisory |
| https://github.com/connorskees/grass/issues/116 | exploitissue-tracking |
| https://github.com/connorskees/grass/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| connorskees | grass |
Affected:
0.13.0
Affected: 0.13.1 Affected: 0.13.2 Affected: 0.13.3 Affected: 0.13.4 cpe:2.3:a:connorskees:grass:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14650",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-06T16:36:16.479783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-06T16:51:14.200Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:connorskees:grass:*:*:*:*:*:*:*:*"
],
"modules": [
"UTF-8 Character Handler"
],
"product": "grass",
"vendor": "connorskees",
"versions": [
{
"status": "affected",
"version": "0.13.0"
},
{
"status": "affected",
"version": "0.13.1"
},
{
"status": "affected",
"version": "0.13.2"
},
{
"status": "affected",
"version": "0.13.3"
},
{
"status": "affected",
"version": "0.13.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Zyz3366 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in connorskees grass up to 0.13.4. The affected element is the function grass_compiler::raw_to_parse_error of the component UTF-8 Character Handler. Executing a manipulation can lead to denial of service. The attack is restricted to local execution. The exploit has been published and may be used. In Issue #117 with similar structure the project maintainer explains: \"DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T20:00:08.823Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-376163 | connorskees grass UTF-8 Character raw_to_parse_error denial of service",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/376163"
},
{
"name": "VDB-376163 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/376163/cti"
},
{
"name": "CVE-2026-14650 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-14650"
},
{
"name": "Submit #846665 | grass 0.13.4 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/846665"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/connorskees/grass/issues/116"
},
{
"tags": [
"product"
],
"url": "https://github.com/connorskees/grass/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-03T20:45:47.000Z",
"value": "VulDB entry last update"
}
],
"title": "connorskees grass UTF-8 Character raw_to_parse_error denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-14650",
"datePublished": "2026-07-04T20:00:08.823Z",
"dateReserved": "2026-07-03T18:40:38.396Z",
"dateUpdated": "2026-07-06T16:51:14.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}