Executive brief
ng-packagr is a build tool used to package Angular libraries. Versions before 10.1.1 allow an attacker to execute arbitrary OS commands by injecting malicious code through the styleIncludePaths configuration option. An attacker with control over a build configuration could execute commands on the build machine, potentially compromising the integrity of built packages.
Technical details
The vulnerability is a command injection (CWE-78) in ng-packagr's handling of the styleIncludePaths option. The vulnerable code used execFile to process user-controlled input without proper sanitization, allowing shell metacharacters to escape and execute arbitrary commands. An attacker must have access to modify the ng-packagr configuration (ng-package.json or build script) to exploit this. The fix (commit bda0fff) replaced execFile with execFileSync and implemented proper input validation. Affected versions are all releases before 10.1.1.
Affected products
- ng-packagr ng-packagr before 10.1.1
Timeline
- 2020-09-25: disclosed
- 2021-04-27: patched: Fix published in version 10.1.1
- 2021-05-07: advisory: GHSA-qm28-7hqv-wg5j advisory published