Read the docs
TI-2019-08064 Aliases CVE-2019-10799GHSA-79qm-h35f-hr77

OS command injection in compile-sass

Priority MEDIUM 40CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExit(cssPath)" within "dist/index.js" is executed as part of the "rm" command without any sanitization.

Why it matters now

EPSS 0.02266 83rd percentileScored 2026-11-07
Fix Fixed compile-sass: 1.0.5compile-sass (npm): 1.0.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—compile-sassbefore 1.0.51.0.5Patch availableCNA
—compile-sass (npm)before 1.0.51.0.5Patch availableGHSA-79qm-h35f-hr77
  • compile-sass Vendor— Affected before 1.0.5 Fixed in 1.0.5 Patch available CNA
  • compile-sass (npm) Vendor— Affected before 1.0.5 Fixed in 1.0.5 Patch available GHSA-79qm-h35f-hr77

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:compile-sass_project:compile-sass:*:*:*:*:*:*:*:*before 1.0.5VulnerableCompile-sass Project
  • cpe:2.3:a:compile-sass_project:compile-sass:*:*:*:*:*:*:*:* Versions before 1.0.5 Vulnerable ·Compile-sass Project

Remediation

  • Fix · CNA compile-sass Fixed in 1.0.5
  • Fix · GHSA-79qm-h35f-hr77 compile-sass (npm) Fixed in 1.0.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10799
  2. 2026-10-03 Alias added: GHSA-79qm-h35f-hr77

References

Patch 1

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences