Description
Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.
Remediation
References
https://github.com/sass/node-sass/pull/567#issuecomment-656609236
Related Vulnerabilities
CVE-2016-4978 Vulnerability in maven package org.apache.activemq:artemis-jms-client
CVE-2018-11697 Vulnerability in maven package org.webjars.npm:node-sass
CVE-2022-23617 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore
CVE-2021-21162 Vulnerability in npm package electron
CVE-2014-3490 Vulnerability in maven package org.jboss.resteasy:resteasy-jaxb-provider