Libsass is a C++ implementation of the Sass CSS preprocessor that achieves prominence in the web development ecosystem through broad embedding in build tools, frameworks, and web-platform projects rather than through direct user deployment. Its vulnerability footprint concentrates in a single product line and recurs through parser-oriented weakness classes including out-of-bounds reads, uncontrolled recursion, improper input validation, and resource-cleanup issues, reflecting the complexity of recursive descent parsing and style-sheet compilation. Defenders should prioritize tracking this vendor's updates in their build-chain dependencies and test frameworks, since a flaw in the compiler can propagate to generated artifacts across downstream projects; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Libsass over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-11556HIGH There is a stack consumption vulnerability in the Parser::advanceToNextToken function in parser.cpp in LibSass 3.4.5. A crafted input may lead to remote denial of service. | Jul 23, 2017 | 7.5 | 24 | NO | NO |
CVE-2017-11554HIGH There is a stack consumption vulnerability in the lex function in parser.hpp (as used in sassc) in LibSass 3.4.5. A crafted input will lead to a remote denial of service. | Jul 23, 2017 | 7.5 | 24 | NO | NO |
CVE-2017-12964HIGH There is a stack consumption issue in LibSass 3.4.5 that is triggered in the function Sass::Eval::operator() in eval.cpp. It will lead to a remote denial of service attack. | Aug 18, 2017 | 7.5 | 22 | NO | NO |
CVE-2017-11605MEDIUM There is a heap based buffer over-read in LibSass 3.4.5, related to address 0xb4803ea1. A crafted input will lead to a remote denial of service attack. | Jul 24, 2017 | 6.5 | 22 | NO | NO |
CVE-2017-11608MEDIUM There is a heap-based buffer over-read in the Sass::Prelexer::re_linebreak function in lexer.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial of service attack. | Jul 24, 2017 | 6.5 | 21 | NO | NO |
CVE-2017-11341HIGH There is a heap based buffer over-read in lexer.hpp of LibSass 3.4.5. A crafted input will lead to a remote denial of service attack. | Jul 17, 2017 | 7.5 | 21 | NO | NO |
CVE-2017-10687HIGH In LibSass 3.4.5, there is a heap-based buffer over-read in the function json_mkstream() in sass_context.cpp. A crafted input will lead to a remote denial of service attack. | Jun 29, 2017 | 7.5 | 20 | NO | NO |
CVE-2017-12963HIGH There is an illegal address access in Sass::Eval::operator() in eval.cpp of LibSass 3.4.5, leading to a remote denial of service attack. NOTE: this is similar to CVE-2017-11555 but | Aug 18, 2017 | 7.5 | 19 | NO | NO |
CVE-2017-12962HIGH There are memory leaks in LibSass 3.4.5 triggered by deeply nested code, such as code with a long sequence of open parenthesis characters, leading to a remote denial of service att | Aug 18, 2017 | 7.5 | 19 | NO | NO |
CVE-2017-11555HIGH There is an illegal address access in the Eval::operator function in eval.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial of service. | Jul 23, 2017 | 7.5 | 19 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Libsass.
Media articles that mention a CVE ID that affects a product developed by Libsass — matched by CVE ID, not by vendor name.