Lucene search
GoogleOSV:GHSA-7MWH-4PQV-WMR8HistoryJul 02, 2022 - 12:00 a.m.
Regular expression denial of service in scss-tokenizer
2022-07-0200:00:19
Google
osv.dev
146
0.001 Low
EPSS
Percentile
46.3%
All versions of the package scss-tokenizer prior to 0.4.3 are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.
| CPE | Name | Operator | Version |
|---|---|---|---|
| scss-tokenizer | lt | 0.4.3 |
References
github.com/sasstools/scss-tokenizer
github.com/sasstools/scss-tokenizer/commit/a53b6f233e648cc01acbdd89c58786cf8ba56e35
github.com/sasstools/scss-tokenizer/issues/45
github.com/sasstools/scss-tokenizer/pull/49
nvd.nist.gov/vuln/detail/CVE-2022-25758
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2936782
snyk.io/vuln/SNYK-JS-SCSSTOKENIZER-2339884
Related
cvelist
cvelist
CVE-2022-25758 Regular Expression Denial of Service (ReDoS)
2022-07-01 00:00:00
ibm
ibm
redhatcve
redhatcve
CVE-2022-25758
2022-08-03 10:10:34
prion
prion
Design/Logic Flaw
2022-07-01 20:15:00
cve
cve
CVE-2022-25758
2022-07-01 20:15:00
veracode
veracode
Regular Expression Denial Of Service (ReDoS)
2022-07-04 04:24:30
github
github
Regular expression denial of service in scss-tokenizer
2022-07-02 00:00:19
ubuntucve
ubuntucve
CVE-2022-25758
2022-07-01 00:00:00