← Back to CVE Explorer

CVE-2026-14650

Full vulnerability record from the local CVENow database.

Description

A flaw has been found in connorskees grass up to 0.13.4. The affected element is the function grass_compiler::raw_to_parse_error of the component UTF-8 Character Handler. Executing a manipulation can lead to denial of service. The attack is restricted to local execution. The exploit has been published and may be used. In Issue #117 with similar structure the project maintainer explains: "DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential."

Severity
LOW
CVSS score
1.9 (v4.0)
Vulnerability status
Deferred
Source identifier
[email protected]
Published
2026-07-04 20:16:55.117000
Last modified
2026-10-25 15:10:00.147000
View original CVE JSON 
{
  "id": "CVE-2026-14650",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-04T20:16:55.117",
  "lastModified": "2026-10-25T15:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw has been found in connorskees grass up to 0.13.4. The affected element is the function grass_compiler::raw_to_parse_error of the component UTF-8 Character Handler. Executing a manipulation can lead to denial of service. The attack is restricted to local execution. The exploit has been published and may be used. In Issue #117 with similar structure the project maintainer explains: \"DoS vulnerabilities are generally fine in Sass compilers -- they are trivially possible with recursive functions, infinite loops, nested mixins, etc. The description here is wrong. Compile time is not expected to be linear relative to the input, and the @extend algorithm is definitionally exponential.\""
    },
    {
      "lang": "es",
      "value": "Se ha encontrado una vulnerabilidad en connorskees grass hasta la versión 0.13.4. El elemento afectado es la función grass_compiler::raw_to_parse_error del componente Gestor de Caracteres UTF-8. La ejecución de una manipulación puede conducir a una denegación de servicio. El ataque está restringido a la ejecución local. El exploit ha sido publicado y puede ser utilizado. En el Issue #117 con una estructura similar, el mantenedor del proyecto explica: ’Las vulnerabilidades DoS generalmente no son un problema grave en los compiladores Sass -- son trivialmente posibles con funciones recursivas, bucles infinitos, mixins anidados, etc. La descripción aquí es incorrecta. No se espera que el tiempo de compilación sea lineal en relación con la entrada, y el algoritmo @extend es exponencial por definición.’"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "connorskees",
          "product": "grass",
          "cpes": [
            "cpe:2.3:a:connorskees:grass:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "UTF-8 Character Handler"
          ],
          "versions": [
            {
              "version": "0.13.0",
              "status": "affected"
            },
            {
              "version": "0.13.1",
              "status": "affected"
            },
            {
              "version": "0.13.2",
              "status": "affected"
            },
            {
              "version": "0.13.3",
              "status": "affected"
            },
            {
              "version": "0.13.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 1.9,
          "baseSeverity": "LOW",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 3.3,
          "baseSeverity": "LOW",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4
      }
    ],
    "cvssMetricV2": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P",
          "baseScore": 1.7,
          "accessVector": "LOCAL",
          "accessComplexity": "LOW",
          "authentication": "SINGLE",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "PARTIAL"
        },
        "baseSeverity": "LOW",
        "exploitabilityScore": 3.1,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-06T16:36:16.479783Z",
          "id": "CVE-2026-14650",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-404"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/connorskees/grass/",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/connorskees/grass/issues/116",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/cve/CVE-2026-14650",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/submit/846665",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/vuln/376163",
      "source": "[email protected]"
    },
    {
      "url": "https://vuldb.com/vuln/376163/cti",
      "source": "[email protected]"
    }
  ]
}