1 known vulnerability, worst severity HIGH.
0 direct dependencies
none carry a known advisory
0 packages depend on it
an advisory here reaches each of them
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so rubygems packages are not covered.
severity band, no base score published
chance of exploitation in 30 days
CyberXYZ composite out of 10
fig. 01 — GHSA-6wmf-3r64-vcwv, the advisory selected below
Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting in a crash.
// patchesThis is fixed in Crass 1.0.7.
// relatedChecked 2026-10-20 at 23:25 UTC. The most recent advisory here was published 2026-10-20. Updated continuously from NVD, GHSA, OSV and CNA feeds.