CVE-2019-18797 (Medium) detected in node-sass3.5.5

[mend-bolt-for-github[bot]]

CVE-2019-18797 - Medium Severity Vulnerability

Vulnerable Library - node-sass3.5.5

:rainbow: Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: 9dc0cb3749919e1417005d8857fa536e6b1e0d2f

Found in base branch: master

Vulnerable Source Files (1)

/node_modules/node-sass/src/libsass/src/eval.cpp

Vulnerability Details

LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operator()(Sass::Binary_Expression*) in eval.cpp.

Publish Date: 2019-11-06

URL: CVE-2019-18797

CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2019-18797

Release Date: 2019-11-06

Fix Resolution: GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105;node-sass - 4.14.0,4.8.0;Fable.Template.Elmish.React - 0.1.6

---

Step up your Open Source Security Game with Mend here