Executive brief
gulp-scss-lint is a build tool plugin used by developers to lint SCSS stylesheets. The tool fails to properly sanitize command-line options, allowing an attacker to inject and execute arbitrary system commands. This could lead to complete system compromise, data theft, or deployment of malware on the developer's machine or build server.
Technical details
The vulnerability is an OS command injection (CWE-78) in the exec function located in src/command.js. Untrusted input from the options parameter is passed directly to shell execution without proper sanitization or escaping. An attacker can provide malicious values in the "src" option or other parameters to inject arbitrary shell commands. The attack requires no authentication or user interaction—an attacker only needs to control or influence the options passed to the gulp-scss-lint module (e.g., via a malicious package in dependencies, a compromised configuration file, or direct usage in a build pipeline). Versions through 1.0.0 are affected. A fix was pushed to the master branch but has not been released to npm as of the advisory publication date.
Affected products
- gulp-scss-lint gulp-scss-lint through 1.0.0
Timeline
- 2020-03-13: disclosed: Published by JHU System Security Lab
- 2021-05-07: advisory: GitHub Security Advisory GHSA-g4hj-r7r3-9rwv published