PT-2020-21211 · Node · Node-Sass

Published 2020-09-11 · Updated 2020-09-11

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions node-sass versions prior to 4.13.1

Description The issue allows attackers to crash the system's running Node process, leading to Denial of Service. This can be achieved by passing crafted objects to the renderSync function, which may trigger C++ assertions in CustomImporterBridge::get importer entry and CustomImporterBridge::post process return value that crash the Node process.

Recommendations Upgrade to version 4.13.1 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

GHSA-9V62-24CR-58CX

Affected Products

Node-Sass

References · 4

• https://osv.dev/vulnerability/GHSA-9v62-24cr-58cx · Vendor Advisory
• https://github.com/sass/node-sass/commit/338fd7a14d3b8bd374a382336df16f9c6792b884 · Note
• https://github.com/sass/node-sass · Note
• https://npmjs.com/advisories/961 · Note