All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.
Weakness
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Scss-tokenizer | Scss-tokenizer_project | * | * |
| Node-node-sass | Ubuntu | focal | * |
| Node-node-sass | Ubuntu | impish | * |
| Node-node-sass | Ubuntu | kinetic | * |
| Node-node-sass | Ubuntu | lunar | * |
| Node-node-sass | Ubuntu | mantic | * |
| Node-node-sass | Ubuntu | oracular | * |
| Node-node-sass | Ubuntu | plucky | * |
Potential Mitigations
Related Attack Patterns
References
- https://github.com/sasstools/scss-tokenizer/issues/45
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2936782
- https://snyk.io/vuln/SNYK-JS-SCSSTOKENIZER-2339884
- https://github.com/sasstools/scss-tokenizer/issues/45
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2936782
- https://snyk.io/vuln/SNYK-JS-SCSSTOKENIZER-2339884