Vulnerability in scss-tokenizer via sass-graph

[StephenTG]

There's a High severity vulnerability in scss-tokenizer (see https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25758), which is included in this project via sass-graph.

[evenstensberg]

Could you send a PR to scss-tokenizer and update the dep here?

• https://github.com/sasstools/scss-tokenizer
• https://github.com/webpack-contrib/sass-loader/pulls

[StephenTG]

Looks like there's been a PR for almost 2 years for this: https://github.com/sasstools/scss-tokenizer/pull/50

[evenstensberg]

Last commit was 2years ago, so I don't think we will be able to fix this.

[StephenTG]

sass-graph has a similar lack of recent updates, is there an alternative for that which could be used?

[evenstensberg]

I've contacted the maintainer of scss-tokenizer, so will await what he answers.

[alexander-akait]

Sorry, we can't fix it here, also node-sass is deprecated, please migrate on sass (dart) or sass-embedded