Read the docs
TI-2022-21168 Aliases CVE-2022-43357GHSA-j7vr-2gc9-mmv7

Stack overflow vulnerability in ast_selectors.cpp in function…

Priority HIGH 72CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

Stack overflow vulnerability in ast_selectors.cpp in function Sass::CompoundSelector::has_real_parent_ref in libsass:3.6.5-8-g210218, which can be exploited by attackers to causea denial of service (DoS). Also affects the command line driver for libsass, sassc 3.6.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01517 74th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:sass-lang:libsass:3.6.5-8-g210218:*:*:*:*:*:*:*3.6.5-8-g210218VulnerableSass-lang
cpe:2.3:a:sass-lang:sassc:3.6.2:*:*:*:*:*:*:*3.6.2VulnerableSass-lang
  • cpe:2.3:a:sass-lang:libsass:3.6.5-8-g210218:*:*:*:*:*:*:* Versions 3.6.5-8-g210218 Vulnerable ·Sass-lang
  • cpe:2.3:a:sass-lang:sassc:3.6.2:*:*:*:*:*:*:* Versions 3.6.2 Vulnerable ·Sass-lang

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-43357
  2. 2026-10-03 Alias added: GHSA-j7vr-2gc9-mmv7

References

Exploit 2

Other 1

  • TI-2022-21169 Stack overflow vulnerability in ast_selectors.cpp: in function… CVSS 3.1HIGH 7.5
  • TI-2018-08219 A use-after-free vulnerability exists in handle_error() in sass_context.cpp in LibSass… CVSS 3.0CRITICAL 9.8
  • TI-2022-09890 Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::has_real_parent_ref function. CVSS 3.1HIGH 8.8
  • TI-2018-14042 In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in… CVSS 3.0HIGH 8.8
  • TI-2018-08363 An issue was discovered in LibSass through 3.5.4. CVSS 3.0HIGH 8.8
  • TI-2018-08362 An issue was discovered in LibSass <3.5.3. CVSS 3.0HIGH 8.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences