View all vulnerabilities

CVE-2022-25758

Regular expression denial of service in scss-tokenizer

All versions of the package `scss-tokenizer` prior to 0.4.3 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `loadAnnotation()` function, due to the usage of insecure regex.

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading
Vulnerability Details
Score
7.5
Score Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Versions
scss-tokenizer < 0.4.3
Severity
High
Ecosystem
JavaScript
Publish Date
July 1, 2022
Modified Date
November 7, 2023