17 matches found
Prototype Pollution
sassdoc-extras is vulnerable to Prototype Pollution. The vulnerability is due to improper validation of user-supplied input in the byGroupAndType function, which allows an attacker to inject arbitrary properties into Object.prototype, potentially leading to denial of service or unexpected...
EUVD-2025-31057
Malicious code in bioql PyPI...
CVE-2025-57326
A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service DoS as the minimum consequence...
GHSA-3MPM-JX38-9M8W sassdoc-extras vulnerable to prototype pollution
A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service DoS as the minimum consequence...
Prototype Pollution
Overview sassdoc-extras is a SassDoc's Toolbelt Affected versions of this package are vulnerable to Prototype Pollution via the byGroupAndType function. An attacker can inject arbitrary properties into Object.prototype by supplying a crafted payload, potentially causing application instability or...
sassdoc-extras vulnerable to prototype pollution
A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service DoS as the minimum consequence...
@css-dot/core (>=22.306.0, <=24.105.1), @davidsneighbour/hugo-darkskies (>=1.2024.30, <=1.2026.0) +8 more potentially affected by CVE-2025-57326 via sassdoc-extras (3.0.0)
sassdoc-extras NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on sassdoc-extras and may be impacted: - @css-dot/core =22.306.0, =1.2024.30, =0.6.69-beta.2, =1.2.0, =0.6.1, =1.0.0, =5.0.0-next.8, =4.0.0-rc.1, =0.0.2, =0.0.7 Source cves:...
@css-dot/core (>=22.306.0, <=24.105.1), @davidsneighbour/hugo-darkskies (>=1.2024.30, <=1.2026.0) +8 more potentially affected by CVE-2025-57326 via sassdoc-extras (3.0.0)
sassdoc-extras NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on sassdoc-extras and may be impacted: - @css-dot/core =22.306.0, =1.2024.30, =0.6.69-beta.2, =1.2.0, =0.6.1, =1.0.0, =5.0.0-next.8, =4.0.0-rc.1, =0.0.2, =0.0.7 Source cves:...
@advclb/sassdoc-loader (0.1.0), @alifd/sassdoc-parser (>=0.1.0, <=2.0.1) +148 more potentially affected by CVE-2025-57326 via sassdoc-extras (>=1.0.3, <=3.0.0)
sassdoc-extras NPM version =1.0.3, =0.1.0, =0.0.3, =0.0.3, =0.0.8, =3.0.0, =3.2.0, =2.3.0-rc.0, =0.0.1, =0.1.2, =10.1.0, =10.18.0-rc.0, =0.1.18, =99.0.372 and more Source cves: CVE-2025-57326 Source advisory: SNYK:JS-SASSDOCEXTRAS-13110008...
CVE-2025-57326
A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service DoS as the minimum consequence...
CVE-2025-57326: Improperly Controlled Modification of Object Prototype Attributes
A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service DoS as the minimum consequence...
CVE-2025-57326
A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service DoS as the minimum consequence...
CVE-2025-57326
The sassdoc-extras package (versions >=1.0.3,
PT-2025-39335
Name of the Vulnerable Software and Affected Versions sassdoc-extras versions 2.5.1 and before Description A Prototype Pollution issue exists in the byGroupAndType function. This allows attackers to inject properties onto Object.prototype by providing a specially crafted input. This can lead to a...
CVE-2025-57326
A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service DoS as the minimum consequence...
CVE-2025-57326
A Prototype Pollution vulnerability in the byGroupAndType function of sassdoc-extras v2.5.1 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service DoS as the minimum consequence...
SassDoc Extras security vulnerabilities
SassDoc Extras is a SassDoc theme builder from SassDoc Open Source. A security vulnerability exists in SassDoc Extras 2.5.1 and earlier versions, which stems from a prototype contamination in the byGroupAndType function, which allows an attacker to inject attributes via a specially crafted payloa...