CVE-2019-10799: OS Command Injection in compile-sass
Summary
CVE-2019-10799: OS Command Injection in compile-sass. Affects compile-sass versions < 1.0.5. Fixed in 1.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
compile-sass is an npm package used for compiling Sass files. It provides a function called 'setupCleanupOnExit(cssPath)' within the 'dist/index.js' file. This function is responsible for executing the 'rm' command without proper sanitization. Due to this vulnerability, an attacker can inject arbitrary commands, leading to potential remote code execution.
Vulnerability Detail
The vulnerability in compile-sass allows an attacker to execute arbitrary commands through the 'setupCleanupOnExit(cssPath)' function. Since the 'rm' command is executed without sanitization, an attacker can inject malicious commands and potentially gain unauthorized access to the system. This vulnerability has a CVSS score of 9.8 (Critical) and is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command).
How To Fix
Minimum fixed version
1.0.5
This is the first release that contains the fix.
npm install compile-sass@1.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the 'setupCleanupOnExit(cssPath)' function or modify it to properly sanitize the input before executing the 'rm' command. Here's an example of how you can sanitize the input using the 'shell-quote' package:
const shellQuote = require('shell-quote');
function setupCleanupOnExit(cssPath) {
const sanitizedPath = shellQuote.quote([cssPath]);
// Rest of the function implementation
}
Conclusion
The OS Command Injection vulnerability in compile-sass allows an attacker to execute arbitrary commands, potentially leading to unauthorized access and remote code execution. It is crucial to update the package to version 1.0.5 or later to mitigate this vulnerability. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for compile-sass →
FAQ
compile-sass is an npm package used for compiling Sass files. It provides a convenient way to convert Sass code into CSS.
This vulnerability allows an attacker to execute arbitrary commands on the system where compile-sass is being used. This can lead to unauthorized access, data breaches, and potential remote code execution.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the fix for this vulnerability is to update the compile-sass package to version 1.0.5 or later. This version includes the necessary fixes to prevent command injection.
As a temporary workaround, you can avoid using the 'setupCleanupOnExit(cssPath)' function or modify it to properly sanitize the input before executing the 'rm' command. Please refer to the 'workaround' section for an example.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
