NULL Pointer Dereference

Affecting node-sass package, ALL versions

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

node-sass is a Node.js bindings package for libsass.

Affected versions of this package are vulnerable to NULL Pointer Dereference. In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()``(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.

Remediation

There is no fixed version for node-sass.

References

CVSS Score

6.5
medium severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    Required
  • Scope
    Unchanged
  • Confidentiality
    None
  • Integrity
    None
  • Availability
    High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:U/RC:U
Credit
Unknown
CVE
CVE-2018-20190
CWE
CWE-476
Snyk ID
SNYK-JS-NODESASS-535502
Disclosed
17 Dec, 2018
Published
25 Nov, 2019