CVE-2022-25758

Regular expression denial of service in scss-tokenizer

Description

All versions of the package `scss-tokenizer` prior to 0.4.3 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `loadAnnotation()` function, due to the usage of insecure regex.

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading

Vulnerability Details

Score

7.5

Score Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Versions

scss-tokenizer < 0.4.3

Severity

High

Ecosystem

JavaScript

Publish Date

July 1, 2022

Modified Date

November 7, 2023