CVE-2026-14651: grass Compiler DoS Vulnerability

CVE-2026-14651 Overview

CVE-2026-14651 affects the connorskees/grass Sass compiler through version 0.13.4. The vulnerability resides in the grass_compiler::selector::extend and grass_compiler::evaluate::visitor functions. Manipulated input can trigger a denial of service (DoS) condition during compilation. The attack requires local access and low privileges. The exploit has been publicly disclosed.

The project maintainer disputes the severity, noting that DoS conditions are inherent to Sass compilers because recursive functions, infinite loops, and nested mixins can trigger them trivially. The maintainer further states that the @extend algorithm is definitionally exponential and compile time is not expected to scale linearly with input size.

Critical Impact
Local attackers supplying crafted Sass input can exhaust CPU or memory resources during compilation, halting build pipelines using vulnerable versions of grass.

Affected Products

connorskees/grass Sass compiler versions up to and including 0.13.4
Rust projects and build pipelines depending on the grass crate
Static site generators and asset toolchains embedding grass_compiler

Discovery Timeline

2026-07-04 - CVE-2026-14651 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14651

Vulnerability Analysis

The issue is classified under [CWE-404] Improper Resource Shutdown or Release. It manifests during the selector extension and evaluation phases of Sass compilation. When the compiler processes deeply nested or recursively referencing selectors, the @extend implementation exhibits exponential time complexity. A local user submitting a crafted .scss file can force the compiler into prolonged execution, consuming CPU and memory until the process is terminated.

The attack surface is limited to environments that accept untrusted Sass source input for compilation. Build servers, continuous integration workers, and multi-tenant preview environments that compile user-supplied stylesheets are the primary exposure points.

Root Cause

The root cause lies in the algorithmic complexity of the @extend operator combined with the visitor traversal in grass_compiler::evaluate::visitor. The maintainer acknowledges that the algorithm is inherently exponential and considers this behavior expected for Sass compilers. No bounds are enforced on selector expansion depth or iteration count during compilation.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker submits a crafted Sass source file to a system that invokes grass to compile it. The compilation process then consumes disproportionate resources relative to the input size, resulting in denial of service against the build host.

Because no verified proof-of-concept code is published in the referenced advisories, refer to GitHub Issue #117 and the VulDB entry for CVE-2026-14651 for input patterns that reproduce the condition.

Detection Methods for CVE-2026-14651

Indicators of Compromise

grass compiler processes running significantly longer than baseline for a given input size
Build pipeline jobs timing out or being killed by OOM handlers while invoking grass
Sudden CPU saturation on build hosts correlated with Sass compilation tasks

Detection Strategies

Instrument build systems to log per-file grass compilation duration and flag outliers.
Monitor for grass_compiler process memory growth exceeding expected thresholds per input size.
Track exit codes and SIGKILL events on CI workers executing Sass compilation.

Monitoring Recommendations

Alert on grass invocations exceeding a configured wall-clock timeout, such as 30 seconds.
Collect telemetry on selector complexity in Sass sources before submission to the compiler.
Review the connorskees/grass GitHub repository for updated advisories and release notes.

How to Mitigate CVE-2026-14651

Immediate Actions Required

Restrict grass invocation to trusted Sass input sources and reject user-supplied stylesheets on shared build infrastructure.
Enforce hard timeouts and memory limits on any process that invokes grass_compiler.
Sandbox compilation jobs using cgroups, containers, or ephemeral runners with strict resource caps.

Patch Information

No fixed version is identified in the CVE record. The project maintainer disputes the vulnerability characterization and considers exponential compile time expected behavior for Sass @extend. Monitor the connorskees/grass GitHub repository and GitHub Issue #117 for any future upstream response.

Workarounds

Apply per-job CPU time limits using ulimit -t or systemd CPUQuota on build workers.
Set memory ceilings with cgroup memory.max or container resource limits to bound worst-case usage.
Pre-validate Sass sources by measuring selector nesting depth and @extend usage before compilation.
Isolate untrusted compilation workloads in disposable containers that are destroyed after each job.

bash

# Configuration example: constrain grass compilation with timeout and cgroup limits
timeout 30s systemd-run --scope \
  -p CPUQuota=50% \
  -p MemoryMax=512M \
  grass input.scss output.css