CVE-2019-10799 (JSON, published 2020-02-24T18:15Z)
Description: value: compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExit(cssPath)" within "dist/index.js" is executed as part of the "rm" command without any sanitization.
Severity: HIGH (CVSS v3 base score: 8.2)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/eiskalteschatten/compile-sass
Files changed:
Readme.md
package-lock.json
package.json
src/index.ts
Commit message: Fix a security vulnerability


Vulnerable code:
  "version": "1.0.4",
      "version": "7.1.4",
      "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.1.4.tgz",
      "integrity": "sha512-c/5MuRz5HM4aizqL5ViYfW4iEnmfPcfbH4Xa6GgLT21dMc1NGeNnuS6egHheOmP+kCJ9CAzC4pv4SDCWTnRkbg==",
      "version": "7.0.8",
      "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.0.8.tgz",
      "integrity": "sha512-yGeB2dHEdvxjP0y4UbRtQaSkXJ9649fYCmIdRoul5kfAoGCwxuCbMhag0k3RPfnuh9kPGm8x89btcfDEXdVWGw==",
      "version": "12.12.27",
      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.12.27.tgz",
      "integrity": "sha512-odQFl/+B9idbdS0e8IxDl2ia/LP8KZLXhV3BUeI98TrZp0uoIzQPhGd+5EtzHmT0SMOIaPd7jfz6pOHLWTtl7A==",
      "version": "1.3.5",
      "resolved": "https://registry.npmjs.org/make-error/-/make-error-1.3.5.tgz",
      "integrity": "sha512-c3sIjNUow0+8swNwVpqoH4YCShKNFkMaw6oH1mNS2haDZQqkeZFlHS3dhoeEbKKmJB4vXpJucU6oH75aDYeE9g==",
      "version": "3.7.5",
      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.7.5.tgz",
      "integrity": "sha512-/P5lkRXkWHNAbcJIiHPfRoKqyd7bsyCma1hZNUGfn20qm64T6ZBlrzprymeu918H+mB/0rIg2gGK/BXkhhYgBw==",
  "version": "1.0.4",
      exec(`rm -r ${cssPath}`, function(error) {
        if (error) {
          console.error(error);

        console.log('Deleted CSS files');

    hasSetupCleanupOnExit = true;

Fixed code:
### 1.0.5

- Fix a critical security vulnerability


  "version": "1.0.5",
      "version": "7.1.5",
      "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.1.5.tgz",
      "integrity": "sha512-+ckxwNj892FWgvwrUWLOghQ2JDgOgeqTPwrcl+0t1pG59CP8qMJ6S/efmEd999vCFSJKOpyMakvU+w380rduUQ==",
      "version": "7.0.9",
      "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.0.9.tgz",
      "integrity": "sha512-jEFQ8L1tuvPjOI8lnpaf73oCJe+aoxL6ygqSy6c8LcW98zaC+4mzWuQIRCEvKeCOu+lbqdXcg4Uqmm1S8AP1tw==",
      "version": "12.12.28",
      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.12.28.tgz",
      "integrity": "sha512-g73GJYJDXgf0jqg+P9S8h2acWbDXNkoCX8DLtJVu7Fkn788pzQ/oJsrdJz/2JejRf/SjfZaAhsw+3nd1D5EWGg==",
      "version": "1.3.6",
      "resolved": "https://registry.npmjs.org/make-error/-/make-error-1.3.6.tgz",
      "integrity": "sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw==",
      "version": "3.8.2",
      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.8.2.tgz",
      "integrity": "sha512-EgOVgL/4xfVrCMbhYKUQTdF37SQn4Iw73H5BgCrF1Abdun7Kwy/QZsE/ssAy0y4LxBbvua3PIbFsbRczWWnDdQ==",
  "version": "1.0.5",
      fs.lstat(cssPath, (error: Error, stats: fs.Stats): void => {
        if (stats.isDirectory) {
          exec(`rm -r ${cssPath}`, function(error) {
            if (error) {
              console.error(error);
              process.exit(1);
            }
    
            console.log('Deleted CSS files');
          });
        }
        else {
          console.error('Could not delete CSS files because the given path is not a directory:', cssPath);
  
      hasSetupCleanupOnExit = true;