CRITICAL9.8

GHSA-79qm-h35f-hr77

OS Command Injection in compile-sass

Quick fix

GHSA-79qm-h35f-hr77 — compile-sass: upgrade to the fixed version with the command below.

npm install compile-sass@1.0.5

Details

compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExit(cssPath)" within "dist/index.js" is executed as part of the "rm" command without any sanitization.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/compile-sass

Introduced in: 0Fixed in: 1.0.5

Fixnpm install compile-sass@1.0.5

References

https://nvd.nist.gov/vuln/detail/CVE-2019-10799[ADVISORY]
https://github.com/eiskalteschatten/compile-sass/commit/d9ada7797ff93875b6466dea7a78768e90a0f8d2[WEB]
https://github.com/eiskalteschatten/compile-sass[PACKAGE]
https://snyk.io/vuln/SNYK-JS-COMPILESASS-551804[WEB]
https://snyk.io/vuln/SNYK-JS-RPI-548942[WEB]