CVE-2026-93752

HighCVSS 7.5/10Last modified Sep 22, 2026

Description

CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property names. Attackers can supply a stylesheet with a declaration named length to replace the internal counter and trigger excessive memory allocation during cssText serialization, causing process termination.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-915

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 18, 2026
Last modified: Sep 22, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-937537.5deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys bein CVE-2026-937567.2The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CVE-2026-937588.1An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic appl CVE-2026-937598.6Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-CVE-2026-93766.3A vulnerability was determined in JPress up to 1.0.3. The affected element is an unknown function of the file /ucenter/article/doWriteSave o CVE-2026-937608.2Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-b CVE-2026-937617.5An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthent CVE-2026-937629.8Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally suppl CVE-2026-937636.5A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application decl CVE-2026-937646.5Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Appl CVE-2026-937659.1Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are p CVE-2026-937676.5The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter