profile
viewpoint

Ask questionsHigh severity reports by Snyk

NULL Pointer Dereference

Vulnerable module: node-sass
Introduced through: node-sass@4.13.0

Detailed paths

Introduced through: node-sass@4.13.0

Overview

node-sass is a Node.js bindings to libsass.

Affected versions of this package are vulnerable to NULL Pointer Dereference. An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Functions::selector_append which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact. node-sass is affected by this vulnerability due to its bundled usage of libsass. <hr> Use After Free

Vulnerable module: node-sass
Introduced through: node-sass@4.13.0

Detailed paths

Introduced through: node-sass@4.13.0

Overview

node-sass is a Node.js bindings to libsass.

Affected versions of this package are vulnerable to Use After Free. A use-after-free vulnerability exists in handle_error() in sass_context.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged to cause a denial of service (application crash) or possibly unspecified other impact. node-sass is affected by this vulnerability due to its usage of libsass.

sass/node-sass

Answer questions nschonni

Follow #2685

useful!

Related questions

Found orphan CR, try removeCR option with Create-React-App hot 2
[Unsupported] Installing node-sass 4.11.0 with Node 12 hot 2
Cannot download "https://github.com/sass/node-sass/releases/download/v4.13.0/win32-x64-79_binding.node" hot 2
Installation error with node 12 and Archlinux hot 1
Module build failed: Error: Node Sass does not yet support your current environment: Linux 64-bit with Unsupported runtime (53) hot 1
latest 4.12.0 version doesn't support nodejs 6.9.1 hot 1
support for node.js 12.x hot 1
node-sass 4.13 incompatible with latest node 12 version (Utf8Value) hot 1
[Unsupported] Installing node-sass 4.8.3 on Node 10 hot 1
yarn install failed to install node-sass 4.9.2 on Alpine Linux hot 1
"C:\Microsoft.Cpp.Default.props" was not found hot 1
Cannot download "https://github.com/sass/node-sass/releases/download/v4.13.0/win32-x64-79_binding.node" hot 1
Build error with node-sass 4.12 and node 12.11.0 on MacOS hot 1
[Unsupported] Installing node-sass 4.7.2 on Node 12 hot 1
[Unsupported] Installing node-sass 3.13.1 with Node 8 hot 1
Github User Rank List