CVE-2026-14651: Denial of Service in grass Sass Compiler via Selector Expansion

Technical summary

CVE-2026-14651 involves the grass_compiler::selector::extend and grass_compiler::evaluate::visitor functions within the connorskees grass compiler. The vulnerability allows local attackers to trigger computationally expensive selector expansion operations, leading to denial of service through prolonged compilation times. The root cause relates to the exponential nature of the @extend algorithm when processing certain selector patterns. The attack vector is local, requires low privileges, and does not require user interaction. CWE-404 (Improper Resource Validation) is associated with this issue.

Business impact

Organizations using grass for Sass compilation in CI/CD pipelines or build systems may experience increased build times, timeouts, or resource exhaustion when processing untrusted or adversarially crafted stylesheets. In isolated environments where compilation is performed on user-supplied input, this could disrupt service availability. However, given the CVSS 3.3 (LOW) severity rating and the vendor's positioning that this reflects expected algorithmic behavior rather than a true flaw, actual business risk is typically limited to operational inconvenience rather than data loss or system compromise.

Affected systems

The grass Sass compiler through version 0.13.4 is affected. Any system that compiles Sass stylesheets using grass—particularly build servers, development environments, or web applications that dynamically compile user-provided stylesheets—may be impacted. The vulnerability requires local access, limiting exposure in typical cloud or SaaS scenarios where compilation is sandboxed.

Exploitability

The exploit is publicly disclosed. However, actual exploitability is constrained by the requirement for local access and the need to supply malicious Sass input to the compiler. Likelihood of exploitation in production is low unless stylesheets come from untrusted sources. The vendor's technical clarification—that selector expansion is exponential by design—suggests that standard usage patterns are not at risk; targeted adversarial input is required to trigger the condition.

Remediation

Upgrade grass to a version patched after 0.13.4 (verify against the vendor's GitHub repository and release notes for the specific fixed version). If immediate upgrade is not feasible, limit local access to the compilation environment and avoid processing Sass stylesheets from untrusted sources. Consider running compilation in resource-constrained containers with CPU and memory limits to prevent runaway processes.

Patch guidance

Check the connorskees grass project repository for release versions newer than 0.13.4. Apply the latest stable release that addresses this issue. Since the vendor has contextualized this as expected algorithmic behavior rather than a defect, patch releases may focus on optimization or documentation rather than a breaking change. Review release notes to confirm the specific mitigation approach in each version increment.

Detection guidance

Monitor compilation processes for excessive CPU usage or wall-clock time when processing Sass input. Log and alert on compiler processes that exceed baseline execution time by significant margins. In CI/CD environments, enforce build timeouts and capture failed compilation logs for analysis. Static analysis of Sass source code for deeply nested @extend rules or complex selector chains may identify risky patterns before compilation.

Why prioritize this

Although CVE-2026-14651 has a LOW CVSS score (3.3), it warrants attention in environments that process untrusted stylesheets or rely heavily on grass for build automation. Prioritize patching in systems where build reliability directly impacts service delivery. The vendor's stance that this is expected behavior means this should not be treated as an emergency; schedule patching in routine maintenance windows unless you have confirmed exposure to adversarial stylesheet input.

Risk score, explained

The CVSS 3.1 score of 3.3 reflects local-only attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and impact limited to availability (A:L). The score is intentionally low because exploitation requires pre-existing local access and does not lead to confidentiality or integrity violations. The vendor's clarification that exponential behavior is architectural rather than a flaw supports this modest severity rating.

Frequently asked questions