New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

"OS Command Injection" critical alert #96

Open

jasewarner opened this issue Jun 24, 2022 · 0 comments

jasewarner commented Jun 24, 2022

I'm using this package (which is great, by the way – thank you!) and I've noticed a critical alert in my repo titled "OS Command Injection":

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options.

Is there a plan in place to fix this problem in a future release?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment