CVE-2020-7601: OS Command Injection in gulp-scss-lint
Summary
CVE-2020-7601: OS Command Injection in gulp-scss-lint. Affects gulp-scss-lint versions < 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
gulp-scss-lint is an npm package used for linting SCSS files in Gulp workflows. It provides a command-line interface for running SCSS linting tasks. The package is vulnerable to OS command injection, allowing an attacker to execute arbitrary commands. This vulnerability exists in the 'exec' function located in 'src/command.js' and can be exploited by injecting malicious commands through the provided options.
Vulnerability Detail
The OS command injection vulnerability in gulp-scss-lint allows an attacker to execute arbitrary commands on the host system. By injecting malicious commands through the options, an attacker can gain unauthorized access, escalate privileges, or perform other malicious activities. This vulnerability has a severity rating of CRITICAL and a CVSS score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-78.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the latest version of gulp-scss-lint to mitigate the risk.
Conclusion
The OS command injection vulnerability in gulp-scss-lint poses a significant risk to systems using this package. It is crucial to upgrade to version 1.0.1 or higher to protect against potential attacks. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gulp-scss-lint →
FAQ
gulp-scss-lint is an npm package used for linting SCSS files in Gulp workflows. It provides a command-line interface for running SCSS linting tasks.
OS command injection is a vulnerability that allows an attacker to execute arbitrary commands on the host operating system. In this case, the vulnerability exists in gulp-scss-lint, enabling an attacker to inject and execute malicious commands.
The OS command injection vulnerability in gulp-scss-lint can lead to unauthorized access, privilege escalation, and other malicious activities. An attacker could execute arbitrary commands with the privileges of the user running the gulp-scss-lint process.
Yes, a fix is available for this vulnerability. Upgrading gulp-scss-lint to version 1.0.1 or higher will patch the vulnerability and prevent the execution of arbitrary commands.
You can update gulp-scss-lint to the latest version by running the command 'npm install gulp-scss-lint@latest'. This will install the latest version of the package and mitigate the vulnerability.
