Description
Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.
Remediation
References
https://github.com/sass/node-sass/pull/567#issuecomment-656609236
Related Vulnerabilities
CVE-2021-38153 Vulnerability in maven package org.apache.kafka:kafka-clients
CVE-2018-18853 Vulnerability in maven package io.spray:spray-json
CVE-2015-8315 Vulnerability in npm package ms
CVE-2017-12648 Vulnerability in maven package com.liferay:com.liferay.frontend.taglib
CVE-2018-11802 Vulnerability in maven package org.apache.solr:solr-core