AIKIDO-2026-10632
css_parser is vulnerable to Improper Certificate Validation
48
Medium Risk
This Affects:
css_parserTL;DR
Remote stylesheet fetching in lib/css_parser/parser.rb configured HTTPS requests with OpenSSL::SSL::VERIFY_NONE, disabling TLS certificate verification. When applications load CSS over HTTPS through this path, an active network attacker can impersonate remote endpoints and inject tampered stylesheet content. This undermines transport authenticity and integrity for fetched CSS data before parsing. The patch removes the explicit VERIFY_NONE override so normal certificate validation is enforced.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
css_parser is vulnerable to Improper Certificate Validation in versions 1.1.2 - 2.0.0.
How to fix this
Upgrade the css_parser library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant