GitHub Advisoryadvisory · npm

GHSA-r8f7-9pfq-mjmv Improper Certificate Validation in node-sass

MEDIUM Published 2022-02-09 Modified 2023-04-21 Official page ↗
Aliases
CVE-2020-24025
Ecosystem
npm
Packages
node-sass
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-295
Reviewed
2021-04-06

Affected packages

• npm node-sass: >= 2.0.0, < 7.0.0 → fixed in 7.0.0

Description

Certificate validation in node-sass 2.0.0 to 6.0.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.

Related

Alias · CVE (1)

  • CVE-2020-24025 Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References