Closed mend-bolt-for-github[bot] closed 1 year ago
A tokenzier for Sass' SCSS syntax
Library home page: https://registry.npmjs.org/scss-tokenizer/-/scss-tokenizer-0.2.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/scss-tokenizer/package.json
Dependency Hierarchy: - userscripter-1.4.0.tgz (Root Library) - node-sass-4.14.1.tgz - sass-graph-2.2.5.tgz - :x: **scss-tokenizer-0.2.3.tgz** (Vulnerable Library)
Found in HEAD commit: 9c336b0fa3155406498ca56519999606da4494b5
Found in base branch: master
All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.
Publish Date: 2022-07-01
URL: CVE-2022-25758
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2022-25758 - High Severity Vulnerability
Vulnerable Library - scss-tokenizer-0.2.3.tgz
A tokenzier for Sass' SCSS syntax
Library home page: https://registry.npmjs.org/scss-tokenizer/-/scss-tokenizer-0.2.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/scss-tokenizer/package.json
Dependency Hierarchy: - userscripter-1.4.0.tgz (Root Library) - node-sass-4.14.1.tgz - sass-graph-2.2.5.tgz - :x: **scss-tokenizer-0.2.3.tgz** (Vulnerable Library)
Found in HEAD commit: 9c336b0fa3155406498ca56519999606da4494b5
Found in base branch: master
Vulnerability Details
All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.
Publish Date: 2022-07-01
URL: CVE-2022-25758
CVSS 3 Score Details (7.5)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Step up your Open Source Security Game with Mend here