CVE-2020-7601

Name of the Vulnerable Software and Affected Versions gulp-scss-lint versions 1.0.0 and earlier

Description The issue exists due to the lack of measures to neutralize special elements used in the operating system command. This allows a remote attacker to execute arbitrary commands by injecting them into the exec function located in src/command.js via the provided options.

Recommendations For versions 1.0.0 and earlier, consider disabling the exec function in src/command.js until a patch is available to prevent exploitation. Restrict access to the src/command.js file to minimize the risk of arbitrary command execution. Avoid using the exec function with untrusted input to prevent command injection.