{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-44312","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-05-05T19:00:06.022Z","datePublished":"2026-05-14T16:15:04.907Z","dateUpdated":"2026-05-15T18:05:54.862Z"},"containers":{"cna":{"title":"css_parser allows to MITM included https css urls","problemTypes":[{"descriptions":[{"cweId":"CWE-829","lang":"en","description":"CWE-829: Inclusion of Functionality from Untrusted Control Sphere","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-295","lang":"en","description":"CWE-295: Improper Certificate Validation","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.8,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","version":"3.1"}}],"references":[{"name":"https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc","tags":["x_refsource_CONFIRM"],"url":"https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc"},{"name":"https://github.com/premailer/css_parser/issues/185","tags":["x_refsource_MISC"],"url":"https://github.com/premailer/css_parser/issues/185"},{"name":"https://github.com/premailer/css_parser/commit/35e689c904225add78e0c488cf04bad052666449","tags":["x_refsource_MISC"],"url":"https://github.com/premailer/css_parser/commit/35e689c904225add78e0c488cf04bad052666449"},{"name":"https://github.com/premailer/css_parser/commit/e0c95d5abe91b237becb90ff316531a6547ada18","tags":["x_refsource_MISC"],"url":"https://github.com/premailer/css_parser/commit/e0c95d5abe91b237becb90ff316531a6547ada18"}],"affected":[{"vendor":"premailer","product":"css_parser","versions":[{"version":">= 2.0.0, < 2.1.0","status":"affected"},{"version":"< 1.22.0","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-05-14T16:15:04.907Z"},"descriptions":[{"lang":"en","value":"css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allowing a Man-in-the-Middle (MITM) attacker to inject or modify CSS content when stylesheets are loaded via HTTPS. The connection is established with OpenSSL::SSL::VERIFY_NONE, meaning any HTTPS certificate—even entirely untrusted—will be accepted without validation. This vulnerability is fixed in 2.1.0 and 1.22.0."}],"source":{"advisory":"GHSA-ff6c-w6qf-7xqc","discovery":"UNKNOWN"}},"adp":[{"references":[{"url":"https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-15T18:05:24.647346Z","id":"CVE-2026-44312","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-05-15T18:05:54.862Z"}}]}}