WS-2019-0605 (Medium) detected in node-sassv4.12.0
mend-bolt-for-github opened this issue Β· comments
WS-2019-0605 - Medium Severity Vulnerability
Vulnerable Library - node-sassv4.12.0
π Node.js bindings to libsass
Library home page: https://github.com/sass/node-sass.git
Found in HEAD commit: 7f59033ff8afe2f83ad2413d6b10103e2f2d764e
Found in base branch: master
Vulnerability Details
In sass versions between 3.2.0 to 3.6.3 may read 1 byte outside an allocated buffer while parsing a specially crafted css rule.
Publish Date: 2019-07-16
URL: WS-2019-0605
CVSS 3 Score Details (6.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://osv.dev/vulnerability/OSV-2020-734
Release Date: 2019-07-16
Fix Resolution: 3.6.4
Step up your Open Source Security Game with Mend here