CVE-2019-10799: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExit(cssPath)" within "dist/index.js" is executed as part of the "rm" command without any sanitization.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.2
Published: 2020-02-24T18:15Z
Repository: https://github.com/eiskalteschatten/compile-sass
Language: JSON
Files changed: Readme.md, package-lock.json, package.json, src/index.ts
Commit date: 2020-02-21 13:17:07 +0100
Commit message: Fix a security vulnerability

Diff: diff --git a/Readme.md b/Readme.md
index b07b9eb..aebb921 100644
--- a/Readme.md
+++ b/Readme.md
@@ -181,10 +181,15 @@ process.on('SIGINT', () => {
 ```
 
 
 ## Release Notes
 
+### 1.0.5
+
+- Fix a critical security vulnerability
+
+
 ### 1.0.4
 
 - Security updates
 - Update node-sass
 - Update hoek 5 to @hapi/hoek 9
diff --git a/package-lock.json b/package-lock.json
index 4d7c5d9..8b06776 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,8 +1,8 @@
 {
   "name": "compile-sass",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
     "@babel/code-frame": {
       "version": "7.8.3",
@@ -587,13 +587,13 @@
         "@types/istanbul-reports": "^1.1.1",
         "@types/yargs": "^13.0.0"
       }
     },
     "@types/babel__core": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.1.4.tgz",
-      "integrity": "sha512-c/5MuRz5HM4aizqL5ViYfW4iEnmfPcfbH4Xa6GgLT21dMc1NGeNnuS6egHheOmP+kCJ9CAzC4pv4SDCWTnRkbg==",
+      "version": "7.1.5",
+      "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.1.5.tgz",
+      "integrity": "sha512-+ckxwNj892FWgvwrUWLOghQ2JDgOgeqTPwrcl+0t1pG59CP8qMJ6S/efmEd999vCFSJKOpyMakvU+w380rduUQ==",
       "dev": true,
       "requires": {
         "@babel/parser": "^7.1.0",
         "@babel/types": "^7.0.0",
         "@types/babel__generator": "*",
@@ -619,13 +619,13 @@
         "@babel/parser": "^7.1.0",
         "@babel/types": "^7.0.0"
       }
     },
     "@types/babel__traverse": {
-      "version": "7.0.8",
-      "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.0.8.tgz",
-      "integrity": "sha512-yGeB2dHEdvxjP0y4UbRtQaSkXJ9649fYCmIdRoul5kfAoGCwxuCbMhag0k3RPfnuh9kPGm8x89btcfDEXdVWGw==",
+      "version": "7.0.9",
+      "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.0.9.tgz",
+      "integrity": "sha512-jEFQ8L1tuvPjOI8lnpaf73oCJe+aoxL6ygqSy6c8LcW98zaC+4mzWuQIRCEvKeCOu+lbqdXcg4Uqmm1S8AP1tw==",
       "dev": true,
       "requires": {
         "@babel/types": "^7.3.0"
       }
     },
@@ -671,13 +671,13 @@
       "requires": {
         "@types/node": "*"
       }
     },
     "@types/node": {
-      "version": "12.12.27",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.12.27.tgz",
-      "integrity": "sha512-odQFl/+B9idbdS0e8IxDl2ia/LP8KZLXhV3BUeI98TrZp0uoIzQPhGd+5EtzHmT0SMOIaPd7jfz6pOHLWTtl7A==",
+      "version": "12.12.28",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.12.28.tgz",
+      "integrity": "sha512-g73GJYJDXgf0jqg+P9S8h2acWbDXNkoCX8DLtJVu7Fkn788pzQ/oJsrdJz/2JejRf/SjfZaAhsw+3nd1D5EWGg==",
       "dev": true
     },
     "@types/node-sass": {
       "version": "4.11.0",
       "resolved": "https://registry.npmjs.org/@types/node-sass/-/node-sass-4.11.0.tgz",
@@ -4593,13 +4593,13 @@
           "dev": true
         }
       }
     },
     "make-error": {
-      "version": "1.3.5",
-      "resolved": "https://registry.npmjs.org/make-error/-/make-error-1.3.5.tgz",
-      "integrity": "sha512-c3sIjNUow0+8swNwVpqoH4YCShKNFkMaw6oH1mNS2haDZQqkeZFlHS3dhoeEbKKmJB4vXpJucU6oH75aDYeE9g==",
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/make-error/-/make-error-1.3.6.tgz",
+      "integrity": "sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw==",
       "dev": true
     },
     "makeerror": {
       "version": "1.0.11",
       "resolved": "https://registry.npmjs.org/makeerror/-/makeerror-1.0.11.tgz",
@@ -6380,13 +6380,13 @@
         "media-typer": "0.3.0",
         "mime-types": "~2.1.24"
       }
     },
     "typescript": {
-      "version": "3.7.5",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.7.5.tgz",
-      "integrity": "sha512-/P5lkRXkWHNAbcJIiHPfRoKqyd7bsyCma1hZNUGfn20qm64T6ZBlrzprymeu918H+mB/0rIg2gGK/BXkhhYgBw==",
+      "version": "3.8.2",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.8.2.tgz",
+      "integrity": "sha512-EgOVgL/4xfVrCMbhYKUQTdF37SQn4Iw73H5BgCrF1Abdun7Kwy/QZsE/ssAy0y4LxBbvua3PIbFsbRczWWnDdQ==",
       "dev": true
     },
     "union-value": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/union-value/-/union-value-1.0.1.tgz",
diff --git a/package.json b/package.json
index 8c1c847..a0b3950 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "compile-sass",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "A module to compile SASS on-the-fly and/or save it to CSS files",
   "main": "dist/index.js",
   "typings": "dist/index.d.ts",
   "scripts": {
     "test:watch": "NODE_ENV=test jest --watch --verbose .",
diff --git a/src/index.ts b/src/index.ts
index 9fc7d94..a2bfbd3 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -142,18 +142,26 @@ export function compileSassAndSaveMultiple(options: CompileMultipleOptions): Pro
 export function setupCleanupOnExit(cssPath: string) {
   if (!hasSetupCleanupOnExit){
     process.on('SIGINT', () => {
       console.log('Exiting, running CSS cleanup');
 
-      exec(`rm -r ${cssPath}`, function(error) {
-        if (error) {
-          console.error(error);
+      fs.lstat(cssPath, (error: Error, stats: fs.Stats): void => {
+        if (stats.isDirectory) {
+          exec(`rm -r ${cssPath}`, function(error) {
+            if (error) {
+              console.error(error);
+              process.exit(1);
+            }
+    
+            console.log('Deleted CSS files');
+          });
+        }
+        else {
+          console.error('Could not delete CSS files because the given path is not a directory:', cssPath);
           process.exit(1);
         }
-
-        console.log('Deleted CSS files');
       });
+  
+      hasSetupCleanupOnExit = true;        
     });
-
-    hasSetupCleanupOnExit = true;
   }
 }

Vulnerable code:   "version": "1.0.4",
      "version": "7.1.4",
      "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.1.4.tgz",
      "integrity": "sha512-c/5MuRz5HM4aizqL5ViYfW4iEnmfPcfbH4Xa6GgLT21dMc1NGeNnuS6egHheOmP+kCJ9CAzC4pv4SDCWTnRkbg==",
      "version": "7.0.8",
      "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.0.8.tgz",
      "integrity": "sha512-yGeB2dHEdvxjP0y4UbRtQaSkXJ9649fYCmIdRoul5kfAoGCwxuCbMhag0k3RPfnuh9kPGm8x89btcfDEXdVWGw==",
      "version": "12.12.27",
      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.12.27.tgz",
      "integrity": "sha512-odQFl/+B9idbdS0e8IxDl2ia/LP8KZLXhV3BUeI98TrZp0uoIzQPhGd+5EtzHmT0SMOIaPd7jfz6pOHLWTtl7A==",
      "version": "1.3.5",
      "resolved": "https://registry.npmjs.org/make-error/-/make-error-1.3.5.tgz",
      "integrity": "sha512-c3sIjNUow0+8swNwVpqoH4YCShKNFkMaw6oH1mNS2haDZQqkeZFlHS3dhoeEbKKmJB4vXpJucU6oH75aDYeE9g==",
      "version": "3.7.5",
      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.7.5.tgz",
      "integrity": "sha512-/P5lkRXkWHNAbcJIiHPfRoKqyd7bsyCma1hZNUGfn20qm64T6ZBlrzprymeu918H+mB/0rIg2gGK/BXkhhYgBw==",
  "version": "1.0.4",
      exec(`rm -r ${cssPath}`, function(error) {
        if (error) {
          console.error(error);

        console.log('Deleted CSS files');

    hasSetupCleanupOnExit = true;
Fixed code: ### 1.0.5

- Fix a critical security vulnerability


  "version": "1.0.5",
      "version": "7.1.5",
      "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.1.5.tgz",
      "integrity": "sha512-+ckxwNj892FWgvwrUWLOghQ2JDgOgeqTPwrcl+0t1pG59CP8qMJ6S/efmEd999vCFSJKOpyMakvU+w380rduUQ==",
      "version": "7.0.9",
      "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.0.9.tgz",
      "integrity": "sha512-jEFQ8L1tuvPjOI8lnpaf73oCJe+aoxL6ygqSy6c8LcW98zaC+4mzWuQIRCEvKeCOu+lbqdXcg4Uqmm1S8AP1tw==",
      "version": "12.12.28",
      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.12.28.tgz",
      "integrity": "sha512-g73GJYJDXgf0jqg+P9S8h2acWbDXNkoCX8DLtJVu7Fkn788pzQ/oJsrdJz/2JejRf/SjfZaAhsw+3nd1D5EWGg==",
      "version": "1.3.6",
      "resolved": "https://registry.npmjs.org/make-error/-/make-error-1.3.6.tgz",
      "integrity": "sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw==",
      "version": "3.8.2",
      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.8.2.tgz",
      "integrity": "sha512-EgOVgL/4xfVrCMbhYKUQTdF37SQn4Iw73H5BgCrF1Abdun7Kwy/QZsE/ssAy0y4LxBbvua3PIbFsbRczWWnDdQ==",
  "version": "1.0.5",
      fs.lstat(cssPath, (error: Error, stats: fs.Stats): void => {
        if (stats.isDirectory) {
          exec(`rm -r ${cssPath}`, function(error) {
            if (error) {
              console.error(error);
              process.exit(1);
            }
    
            console.log('Deleted CSS files');
          });
        }
        else {
          console.error('Could not delete CSS files because the given path is not a directory:', cssPath);
  
      hasSetupCleanupOnExit = true;