CRITICAL9.8

GHSA-g4hj-r7r3-9rwv

OS Command Injection in gulp-scss-lint

Details

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/gulp-scss-lint

Introduced in: 0

No fixed version published yet for gulp-scss-lint (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2020-7601[ADVISORY]
https://snyk.io/vuln/SNYK-JS-GULPSCSSLINT-560114[WEB]