CVE-2026-14650 Overview
CVE-2026-14650 affects the connorskees/grass Sass compiler through version 0.13.4. The flaw resides in the grass_compiler::raw_to_parse_error function within the UTF-8 Character Handler component. A local attacker supplying crafted input can trigger a denial of service (DoS) condition [CWE-404: Improper Resource Shutdown or Release]. The exploit has been publicly disclosed. The project maintainer notes that DoS conditions are generally acceptable in Sass compilers because recursive functions, infinite loops, and nested mixins make them trivially reachable, and compile time is not expected to be linear relative to input size.
Critical Impact
Local attackers can trigger denial of service in the grass Sass compiler through crafted UTF-8 input processed by raw_to_parse_error.
Affected Products
- connorskees grass Sass compiler versions up to and including 0.13.4
- Applications embedding the grass_compiler crate for Sass compilation
- Build pipelines invoking grass on untrusted stylesheet input
Discovery Timeline
- 2026-07-04 - CVE-2026-14650 published to NVD
- 2026-07-06 - Last updated in NVD database
Technical Details for CVE-2026-14650
Vulnerability Analysis
The vulnerability originates in grass_compiler::raw_to_parse_error, a routine within the UTF-8 Character Handler responsible for converting raw byte offsets into parse error diagnostics. Malformed or adversarially crafted UTF-8 input causes the function to consume excessive resources during compilation. Because the attack surface is limited to local execution and requires low privileges, exploitation is scoped to environments where an attacker can supply Sass source files to the compiler.
The classification under [CWE-404] reflects improper handling of resource release during error path processing. The maintainer has explicitly stated that DoS conditions in Sass compilers are expected behavior given the language's support for recursion, unbounded loops, and the exponential nature of the @extend algorithm.
Root Cause
The root cause lies in how raw_to_parse_error processes UTF-8 byte boundaries when generating parse error information. Compile time is not linear relative to input size, and specific input patterns can amplify resource consumption during diagnostic construction. No memory corruption or code execution occurs; the impact is confined to availability of the compiler process.
Attack Vector
Exploitation requires local access and the ability to submit a crafted Sass source file to the grass compiler. Remote exploitation is not possible without an intermediary that forwards untrusted input to a local compilation step, such as a shared build environment. The vulnerability does not affect confidentiality or integrity of processed data.
No verified proof-of-concept code is included in the advisory. Refer to the GitHub Issue Tracker and the VulDB Vulnerability Detail for reproduction context.
Detection Methods for CVE-2026-14650
Indicators of Compromise
- Unexpectedly long-running or hung grass compiler processes during Sass builds
- Build agents consuming abnormal CPU or memory while processing user-supplied .scss or .sass files
- Repeated build timeouts tied to specific stylesheet inputs originating from untrusted contributors
Detection Strategies
- Monitor process runtime and resource metrics for grass and any binary embedding grass_compiler
- Enforce build-step timeouts in CI/CD pipelines to surface stalled compilations
- Log and review stylesheet inputs from external contributors before allowing them into shared build infrastructure
Monitoring Recommendations
- Track CPU and memory ceilings on build workers processing Sass sources
- Alert on build jobs exceeding baseline compile duration for equivalent input sizes
- Correlate build failures with recently added or modified .scss files in version control
How to Mitigate CVE-2026-14650
Immediate Actions Required
- Restrict grass compilation to trusted Sass source input only
- Apply strict CPU and memory limits to build processes invoking the compiler
- Isolate build workers processing third-party stylesheets in ephemeral, resource-bounded containers
Patch Information
At the time of publication, no fixed version is referenced in the advisory metadata. Monitor the connorskees/grass GitHub repository for releases beyond 0.13.4 that address raw_to_parse_error behavior. Additional context is available in the VulDB CVE Database Entry.
Workarounds
- Enforce input size limits on Sass source files submitted to the compiler
- Run grass under ulimit or cgroup constraints capping CPU time and memory
- Reject or sandbox stylesheet input from untrusted users prior to compilation
- Use build-job timeouts to terminate runaway grass processes automatically
# Configuration example: constrain grass with resource limits
ulimit -t 30 -v 524288
timeout 60s grass input.scss output.css
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
