Libsass
Vendor:
First CVE: May 26, 2018 · Active for 8 years
27
Total CVEs
More Total CVEs than 96% of tracked products
9.0
Avg CVEs / Year
Higher CVE frequency than 95% of tracked products
7.3
Avg CVSS
Higher Avg CVSS than 46% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Libsass over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 26, 2018
8 years ago
Most Recent CVE
Aug 22, 2023
1,070 days ago
CVE Severity & Scoring
Libsass27 CVEs
59%
37%
All CVEs352,727 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network27 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low27 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None3 (11.1%)
Unknown0 (0.0%)
Required24 (88.9%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None27 (100.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (27 CVEs).
27 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-11499CRITICAL A use-after-free vulnerability exists in handle_error() in sass_context.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged to cause a denial of service (applicati | May 26, 2018 | 9.8 | 30 | NO | NO |
CVE-2018-19827HIGH In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibl | Dec 3, 2018 | 8.8 | 27 | NO | NO |
CVE-2018-11696HIGH An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Inspect::operator which could be leveraged by an attacker to cause a de | Jun 4, 2018 | 8.8 | 26 | NO | NO |
CVE-2018-11695HIGH An issue was discovered in LibSass <3.5.3. A NULL pointer dereference was found in the function Sass::Expand::operator which could be leveraged by an attacker to cause a denial of | Jun 4, 2018 | 8.8 | 26 | NO | NO |
CVE-2018-11694HIGH An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Functions::selector_append which could be leveraged by an attacker to c | Jun 4, 2018 | 8.8 | 26 | NO | NO |
CVE-2018-11693HIGH An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::skip_over_scopes which could be leveraged by an | Jun 4, 2018 | 8.1 | 26 | NO | NO |
CVE-2018-11698HIGH An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::handle_error which could be leveraged by an attacker to d | Jun 4, 2018 | 8.1 | 25 | NO | NO |
CVE-2018-11697HIGH An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::exactly() which could be leveraged by an attack | Jun 4, 2018 | 8.1 | 25 | NO | NO |
CVE-2022-26592HIGH Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::has_real_parent_ref function. | Aug 22, 2023 | 8.8 | 23 | NO | NO |
CVE-2018-20822MEDIUM LibSass 3.5.4 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Complex_Selector::perform in ast.hpp and Sass::Inspect::operator in inspect.cpp). | Apr 23, 2019 | 6.5 | 23 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (27 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (27 CVEs).
Media Mentions
Signals from CVEs in this product scope (27 CVEs).
Top CNAs Publishing CVEs For Libsass
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 3.6.5-8-g210218 | 2 | 7.5 | 1.3% | 0 | 0 |
| 3.6.5 | 1 | 8.8 | 0.8% | 0 | 0 |
| 3.5.5 | 7 | 6.8 | 2.0% | 0 | 0 |
| 3.5.4 | 1 | 6.5 | 2.1% | 0 | 0 |
| 3.5.0 | 2 | 6.5 | 1.1% | 0 | 0 |