CVE-2022-25758

Description

All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.

References

https://github.com/advisories/GHSA-7mwh-4pqv-wmr8

https://snyk.io/vuln/SNYK-JS-SCSSTOKENIZER-2339884

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2936782

https://github.com/sasstools/scss-tokenizer/issues/45

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS