Denial of Service in Grass Compiler

Publication date: 2026-07-04

Last updated on: 2026-07-04

Assigner: VulDB

Description

A vulnerability has been found in connorskees grass up to 0.13.4. The impacted element is the function grass_compiler::selector::extend/grass_compiler::evaluate::visitor. The manipulation leads to denial of service. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-04

Last Modified

2026-07-04

Generated

2026-07-05

AI Q&A

2026-07-05

EPSS Evaluated

N/A

NVD

CVE-2026-14651

Affected Vendors & Products

Vendor	Product	Version / Range
connorskees	grass	0.13.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-404	The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the connorskees grass software up to version 0.13.4, specifically in the functions grass_compiler::selector::extend and grass_compiler::evaluate::visitor. It allows an attacker with local access to cause a denial of service (DoS) by exploiting the way the software processes certain inputs. The maintainer notes that DoS vulnerabilities are common in Sass compilers due to recursive functions, infinite loops, and nested mixins, and that the @extend algorithm inherently has exponential complexity, which can lead to increased compile times.

Impact Analysis

The primary impact of this vulnerability is a denial of service condition. An attacker with local access can exploit the vulnerability to cause the software to consume excessive resources or hang, leading to unavailability of the affected service or application. Since the attack requires local access, remote exploitation is not possible.

Hi! I’m here to help you understand CVE-2026-14651. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70