Executive brief
compile-sass is a Node.js library for compiling SASS stylesheets to CSS. Versions prior to 1.0.5 allow attackers to execute arbitrary system commands through unsanitized input passed to the cleanup function, potentially enabling full system compromise or data theft.
Technical details
The vulnerability is an OS command injection (CWE-78) in the setupCleanupOnExit() function within dist/index.js. The function constructs an rm command without sanitizing the cssPath parameter, allowing an attacker to inject arbitrary shell commands. Attack requires the attacker to control the input filename passed to compile-sass. Successful exploitation grants the attacker the ability to execute arbitrary commands with the privileges of the process running the library. The vulnerability was patched in version 1.0.5.
Affected products
- compile-sass compile-sass before 1.0.5
Timeline
- 2020-02-24: disclosed: Published to NVD
- 2021-04-13: advisory: GHSA advisory published
- 2021-04-08: patched: Fix available in version 1.0.5