CVE-2026-53727: Ruby CSS Parser SSRF Vulnerability

CVE-2026-53727 Overview

CVE-2026-53727 is a Server-Side Request Forgery (SSRF) vulnerability in the css_parser Ruby gem, affecting versions 2.2.0 through 3.0.0. The CssParser::Parser#read_remote_file method in lib/css_parser/parser.rb issued HTTP and HTTPS requests without a scheme allowlist, host filtering, or protections against link-local, loopback, or RFC-1918 addresses. Because redirects were followed recursively into the same function — which also serviced file:// URIs — an attacker-controlled HTTP redirect could escalate the SSRF into arbitrary local file disclosure. Any application that feeds css_parser attacker-influenced CSS together with a base_uri: option is exposed [CWE-918]. The issue is fixed in version 3.0.0.

Critical Impact
Attackers can pivot from SSRF into arbitrary local file disclosure by returning an HTTP redirect to a file:// URI, exposing secrets, credentials, and configuration files.

Affected Products

css_parser Ruby gem versions 2.2.0 through 2.x
Applications using CssParser::Parser#read_remote_file, load_uri!, or add_block! with attacker-influenced CSS
The premailer project and downstream consumers relying on css_parser for @import following

Discovery Timeline

2026-07-17 - CVE-2026-53727 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-53727

Vulnerability Analysis

The css_parser gem parses CSS documents and, when given a base_uri: option, resolves and fetches referenced stylesheets via @import statements. The read_remote_file method performed no validation on the target scheme, host, or IP address before issuing a network request. Attackers can direct the parser at internal HTTP services, cloud metadata endpoints such as 169.254.169.254, or loopback listeners.

The severity is amplified by unsafe redirect handling. When the remote server returns an HTTP 3xx response, read_remote_file recursed into itself using the Location header. Because the same function also handled file:// URIs, a single attacker-controlled redirect to file:///etc/passwd converted an outbound SSRF into local file read. This transforms a network-side weakness into disclosure of application secrets, SSH keys, and configuration on the host.

Root Cause

The root cause is the absence of a scheme allowlist and destination filtering in read_remote_file, combined with a monolithic fetch routine that serviced both http(s):// and file:// URIs without separating the code paths. Redirect resolution reused the same entry point, so scheme validation performed only on the initial URI was bypassed on subsequent hops.

Attack Vector

An attacker supplies CSS containing @import url("http://attacker.example/redir") (or any URL) to an application that invokes css_parser with a base_uri:. The attacker-controlled server responds with a 302 redirect to file:///etc/passwd or another sensitive local path. The parser follows the redirect through the same fetch function, reads the local file, and returns its contents into the CSS processing pipeline where they may be reflected or logged.

ruby

# Security patch in lib/css_parser.rb (GHSA-9pmc-p236-855h)
 require 'uri'
 require 'net/https'
 require 'digest/md5'
-require 'zlib'
-require 'stringio'
+require 'ssrf_filter'

 require 'css_parser/version'
 require 'css_parser/rule_set'

Source: premailer/css_parser commit 7d2ddf0

ruby

# BUG guard added to prevent LFI gate bypass
     def read_local_file(uri) # :nodoc:
+      # Internal invariant: this method is the implementation of the
+      # `allow_file_uris: true` branch of `load_uri!`. If it is ever
+      # reached without that flag set, a future change has bypassed the
+      # LFI gate; refuse to read rather than silently leak.
+      unless @options[:allow_file_uris]
+        raise "BUG: #{self.class}##{__method__} reached with " \
+              "allow_file_uris=false (LFI gate bypassed)"
+      end
+
       return nil unless circular_reference_check(uri.to_s)

       path = uri.path

Source: premailer/css_parser commit e0a1514

Detection Methods for CVE-2026-53727

Indicators of Compromise

Outbound HTTP or HTTPS requests from application hosts to link-local (169.254.0.0/16), loopback (127.0.0.0/8), or RFC-1918 destinations originating from Ruby processes using css_parser
Application logs showing @import directives resolving to attacker-controlled domains followed by unusual file:// reads
HTTP 3xx responses with Location headers pointing to file:// schemes captured in egress proxies

Detection Strategies

Inventory Ruby applications and Gemfile.lock entries for css_parser versions between 2.2.0 and 3.0.0
Instrument the fetch path to log destination scheme, host, and any redirect chain when parsing user-supplied CSS
Alert on any process reading sensitive files (/etc/passwd, /proc/self/environ, cloud metadata) shortly after inbound CSS parsing activity

Monitoring Recommendations

Enforce egress filtering on application servers and log all denied connections to internal ranges
Monitor for anomalous HTTP redirects from external hosts to non-HTTP schemes at the proxy layer
Correlate web-tier requests containing CSS payloads with subsequent local file access events

How to Mitigate CVE-2026-53727

Immediate Actions Required

Upgrade css_parser to version 3.0.0 or later in all Gemfiles and rebuild deployment artifacts
Audit any application code that passes untrusted CSS or a user-controlled base_uri: to CssParser::Parser
Restrict outbound network access from application workers to only required destinations
Rotate any secrets, tokens, or keys that may have been exposed on affected hosts

Patch Information

The fix is included in css_parser v3.0.0. The patch routes remote fetches through the ssrf_filter gem, separates file:// handling behind an explicit allow_file_uris option, and adds internal invariant guards that raise if the local-file branch is reached without the flag set. See GitHub Security Advisory GHSA-9pmc-p236-855h for full details.

Workarounds

If upgrading is not immediately possible, refuse to pass a base_uri: when parsing untrusted CSS to disable remote and local file resolution
Wrap css_parser calls with a URL validator that rejects non-HTTPS schemes and internal IP ranges before invocation
Block egress from application hosts to link-local, loopback, and RFC-1918 destinations at the network layer

bash

# Update Gemfile to require the patched version
bundle update css_parser --conservative
grep -R "css_parser" Gemfile.lock
# Expected: css_parser (>= 3.0.0) with ssrf_filter (~> 1.5) as a dependency