Description
compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument.
Remediation
References
https://github.com/quaertym/compass-compile/blob/master/lib/compass.js#L25
https://snyk.io/vuln/SNYK-JS-COMPASSCOMPILE-564429
Related Vulnerabilities
CVE-2021-39176 Vulnerability in npm package detect-character-encoding
CVE-2023-26474 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore
CVE-2022-34112 Vulnerability in maven package io.dataease:dataease-plugin-common
CVE-2022-25168 Vulnerability in maven package org.apache.hadoop:hadoop-common
CVE-2022-46907 Vulnerability in maven package org.apache.jspwiki:jspwiki-war