GHSA-79qm-h35f-hr77

Source

https://github.com/advisories/GHSA-79qm-h35f-hr77

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-79qm-h35f-hr77/GHSA-79qm-h35f-hr77.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-79qm-h35f-hr77

Aliases

CVE-2019-10799

Published

2021-04-13T15:23:13Z

Modified

2025-01-14T07:14:22.174630Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

OS Command Injection in compile-sass

Details

compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExit(cssPath)" within "dist/index.js" is executed as part of the "rm" command without any sanitization.

Database specific

{
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-78"
    ],
    "github_reviewed_at": "2021-04-08T20:21:56Z",
    "nvd_published_at": "2020-02-24T18:15:00Z"
}

References

Affected packages

npm / compile-sass

Package

Name: compile-sass; View open source insights on deps.dev
Purl: pkg:npm/compile-sass

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.5