sass-1.99.0.tgz: 2 vulnerabilities (highest severity is: 6.5)

[mend-bolt-for-github]

Vulnerable Library - sass-1.99.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/brace-expansion-npm-5.0.5-b81f6c30d6-10c0.zip

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (sass version)	Remediation Possible**
CVE-2026-45149	Medium	6.5	brace-expansion-5.0.5.tgz	Transitive	N/A*	❌
CVE-2026-42338	Medium	5.4	ip-address-10.1.0.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-45149

Vulnerable Library - brace-expansion-5.0.5.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/brace-expansion-npm-5.0.5-b81f6c30d6-10c0.zip

Dependency Hierarchy:

• sass-1.99.0.tgz (Root Library)
  • watcher-2.4.1.tgz
    • node-gyp-12.1.0.tgz
      • make-fetch-happen-15.0.3.tgz
        • cacache-20.0.3.tgz
          • glob-13.0.0.tgz
            • minimatch-10.2.5.tgz
              • ❌ brace-expansion-5.0.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The "max" option was being applied too late: When expanding a single large numeric range like "{1..10000000}", the sequence generation loop generates all 10 million intermediate elements before the "max" limit is applied With "max=10", the output is correctly limited to 10 items, but the process still allocates "~505 MB" and spends "~800ms" building the full intermediate array. Workaround Ensure the string to be expanded doesn't contain more values than the desired "max" item count.

Publish Date: 2026-05-18

URL: CVE-2026-45149

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jxxr-4gwj-5jf2

Release Date: 2026-05-18

Fix Resolution: brace-expansion - 5.0.6

Step up your Open Source Security Game with Mend here

CVE-2026-42338

Vulnerable Library - ip-address-10.1.0.tgz

A library for parsing IPv4 and IPv6 IP addresses in node and the browser.

Library home page: https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /home/wss-scanner/.yarn/berry/cache/ip-address-npm-10.1.0-d5d5693401-10c0.zip

Dependency Hierarchy:

• sass-1.99.0.tgz (Root Library)
  • watcher-2.4.1.tgz
    • node-gyp-12.1.0.tgz
      • make-fetch-happen-15.0.3.tgz
        • agent-4.0.0.tgz
          • socks-proxy-agent-8.0.5.tgz
            • socks-2.8.7.tgz
              • ❌ ip-address-10.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.

Publish Date: 2026-05-12

URL: CVE-2026-42338

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-v2v4-37r5-5v8g

Release Date: 2026-05-06

Fix Resolution: ip-address - 10.1.1,https://github.com/beaugunderson/ip-address.git - v10.1.1

Step up your Open Source Security Game with Mend here