CVE-2021-28956: Sass Lint Project Sass Lint

High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days.

The unofficial vscode-sass-lint (aka Sass Lint) extension through 1.0.7 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted workspace. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected products

• Sass Lint Project Sass Lint: up to and including 1.0.7

Published 2021-03-22. Last modified 2026-06-17.