Command injection

compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExitcssPath" within "dist/index.js" is executed as part of the "rm" command without any sanitization...

CVE-2019-10799

compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExitcssPath" within "dist/index.js" is executed as part of the "rm" command without any sanitization...

CVE-2019-10799

CVE-2019-10799 affects the compile-sass module prior to version 1.0.5. The root cause is a lack of sanitization in the function setupCleanupOnExit(cssPath) within dist/index.js, which is invoked as part of the rm command, enabling execution of arbitrary commands. The vulnerability allows potentia...

CVE-2019-10799

compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExitcssPath" within "dist/index.js" is executed as part of the "rm" command without any sanitization...

CVE-2019-10799: Improper Neutralization of Special Elements used in an OS Command

compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExitcssPath" within "dist/index.js" is executed as part of the "rm" command without any sanitization...

PT-2020-9150

Name of the Vulnerable Software and Affected Versions compile-sass versions prior to 1.0.5 Description The issue allows execution of arbitrary commands. The function setupCleanupOnExitcssPath within dist/index.js is executed as part of the rm command without any sanitization. Recommendations For...

Command Injection

Overview compile-sass is a module to compile SASS on-the-fly and/or save it to CSS files. Affected versions of this package are vulnerable to Command Injection. The function setupCleanupOnExitcssPath within dist/index.js is executed as part of the rm command without any sanitization. PoC by JHU...

Denial Of Service (DoS)

node-sass is vulnerable to denial of service DoS. The attack is possible because the renderSync function triggers C++ assertions in CustomImporterBridge::getimporterentry and CustomImporterBridge::postprocessreturnvalue, crashing the Node process...

LibSass Uncontrolled Recursion Vulnerability

LibSass is a C/C++ implementation of the Sass compiler. An uncontrolled recursion vulnerability exists in Sass::Eval::operator in eval.cpp in LibSass 3.6.1. No detailed vulnerability details are provided at this time...

LibSass heap buffer overread vulnerability (CNVD-2019-40159)

LibSass is a C/C++ implementation of the Sass compiler. A heap buffer over-read vulnerability exists in Sass::weaveParents in astselweave.cpp in LibSass versions prior to 3.6.3. No details of the vulnerability are provided at this time...

CVE-2019-18797

LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operatorSass::BinaryExpression in eval.cpp...

CVE-2019-18797

LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operatorSass::BinaryExpression in eval.cpp...

DEBIAN-CVE-2019-18799

LibSass before 3.6.3 allows a NULL pointer dereference in Sass::Parser::parseCompoundSelector in parserselectors.cpp...

DEBIAN-CVE-2019-18798

LibSass before 3.6.3 allows a heap-based buffer over-read in Sass::weaveParents in astselweave.cpp...

UBUNTU-CVE-2019-18797

LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operatorSass::BinaryExpression in eval.cpp...

CVE-2019-18798

LibSass before 3.6.3 allows a heap-based buffer over-read in Sass::weaveParents in astselweave.cpp...

CVE-2019-18797

LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operatorSass::BinaryExpression in eval.cpp...

CVE-2019-18797

LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operatorSass::BinaryExpression in eval.cpp...

CVE-2019-18798

LibSass before 3.6.3 allows a heap-based buffer over-read in Sass::weaveParents in astselweave.cpp...

CVE-2019-18799

LibSass before 3.6.3 allows a NULL pointer dereference in Sass::Parser::parseCompoundSelector in parserselectors.cpp...