css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_remote_file in lib/css_parser/parser.rb, and therefore load_uri! and the @import-following branch of add_block!, issued HTTP and HTTPS requests against any host, port, and URI without a scheme allowlist, host or IP filtering, or protection against link-local, loopback, or RFC-1918 addresses. Location: redirects were followed recursively back into the same function, which also serviced file:// URIs, so a single attacker-controlled HTTP redirect could upgrade the bug from SSRF to arbitrary local file disclosure. Any consumer of css_parser that hands it attacker-influenced CSS together with a base_uri: option is exposed. This issue is fixed in version 3.0.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_remote_file in     lib/css_parser/parser.rb, and therefore load_uri! and the @import-following branch of add_block!, issued     HTTP and HTTPS requests against any host, port, and URI without a scheme allowlist, host or IP filtering,     or protection against link-local, loopback, or RFC-1918 addresses. Location: redirects were followed     recursively back into the same function, which also serviced file:// URIs, so a single attacker-controlled     HTTP redirect could upgrade the bug from SSRF to arbitrary local file disclosure. Any consumer of     css_parser that hands it attacker-influenced CSS together with a base_uri: option is exposed. This issue     is fixed in version 3.0.0. (CVE-2026-53727)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_remote_file in
    lib/css_parser/parser.rb, and therefore load_uri! and the @import-following branch of add_block!, issued
    HTTP and HTTPS requests against any host, port, and URI without a scheme allowlist, host or IP filtering,
    or protection against link-local, loopback, or RFC-1918 addresses. Location: redirects were followed
    recursively back into the same function, which also serviced file:// URIs, so a single attacker-controlled
    HTTP redirect could upgrade the bug from SSRF to arbitrary local file disclosure. Any consumer of
    css_parser that hands it attacker-influenced CSS together with a base_uri: option is exposed. This issue
    is fixed in version 3.0.0. (CVE-2026-53727)

ID	Name	Product	Family	Type	Severity
327779	Linux Distros Unpatched Vulnerability : CVE-2026-53727	Nessus	Misc.	Local	high
444563	SCA: security update for css_parser (GHSA-9pmc-p236-855h)	Tenable Cloud Security	SCA Checks	Local	high
444563	SCA: security update for css_parser (GHSA-9pmc-p236-855h)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-53727

high

Tenable Plugins

high

high

high