PatchTheCVEsass-lang vulnerabilities
Recent CVEs affecting sass-lang products. 3 tracked.
sass-lang has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2023-08-22. Highest priority: CVE-2022-43358 (score 55/100).
- CVE-2022-43358 HIGH 7.5 DOWNGRADE Stack overflow vulnerability in ast_selectors.cpp: in function Sass::ComplexSelector::has_placeholder in libsa
- CVE-2022-43357 HIGH 7.5 DOWNGRADE DOWNGRADE Stack overflow vulnerability in ast_selectors.cpp in function Sass::CompoundSelector::has_real_parent_ref in l
- CVE-2022-26592 HIGH 8.8 DOWNGRADE Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::has_real_parent_ref function.
FAQ
How do I fix sass-lang vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is sass-lang being exploited right now?
None of the tracked sass-lang CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which sass-lang CVE should I patch first?
CVE-2022-43358 currently ranks highest (55/100): Stack overflow vulnerability in ast_selectors.cpp: in function Sass::ComplexSelector::has_placeholder in libsa.