CVE-2026-53727 css_parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`
Attackers can exploit Server-Side Request Forgery and local file disclosure in the css_parser library by providing malicious CSS with a base URI.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53727?
CVE-2026-53727 is a high-severity server-side request forgery vulnerability in premailer css_parser, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_remote_file in lib/css_parser/parser.rb, and therefore load_uri! and the @import-following branch of add_block!, issued HTTP and HTTPS requests against any host, port, and URI without a scheme allowlist, host or IP filtering, or protection against link-local, loopback, or RFC-1918 addresses. Location: redirects were followed recursively back into the same function, which also serviced file:// URIs, so a single attacker-controlled HTTP redirect could upgrade the bug from SSRF to arbitrary local file disclosure. Any consumer of css_parser that hands it attacker-influenced CSS together with a base_uri: option is exposed. This issue is fixed in version 3.0.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-53727?
2 open source packages ship an affected version, including css_parser. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
css_parser RubyGems | All versions | 3.0.0 |
css_parser RubyGems | All versions | 3.0.0 |
Products include Premailer Css Parser.
How do I fix CVE-2026-53727?
Upgrade css_parser to 3.0.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-53727 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53727 exists.
Sources
Also known as DEBIAN-CVE-2026-53727, GHSA-9pmc-p236-855h, UBUNTU-CVE-2026-53727.