CVE-2019-10799: 
JavaScript vulnerability analysis and mitigation

The vulnerability CVE-2019-10799 affects the compile-sass package versions below 1.0.5. This security issue was published on February 21, 2020, and involves a Command Injection vulnerability in the setupCleanupOnExit(cssPath) function (Snyk).

The vulnerability exists in the setupCleanupOnExit(cssPath) function within dist/index.js, which is executed as part of the rm command without proper sanitization. This allows for potential command injection attacks. The vulnerability has a CVSS v3.1 base score of 8.2 (High), with attack vector being Network, attack complexity Low, and requiring no privileges or user interaction (Snyk).

If exploited, this vulnerability could lead to a total loss of confidentiality, with all resources within the impacted component being potentially exposed to the attacker. While the integrity impact is considered low, the vulnerability could allow attackers to execute arbitrary commands on the affected system (Snyk).

The recommended mitigation is to upgrade compile-sass to version 1.0.5 or higher, which contains the security fix. The fix was implemented through a patch that adds proper validation of the cssPath parameter before executing the rm command (GitHub).