CVE-2020-7735: 
JavaScript vulnerability analysis and mitigation

The package ng-packagr before version 10.1.1 contained a Command Injection vulnerability via the styleIncludePaths option. This vulnerability was assigned CVE-2020-7735 (CVE Details).

The vulnerability exists in the stylesheet-processor.ts file where the execSync function was used with string concatenation for the LESS compiler command. This implementation allowed for potential command injection through the styleIncludePaths option. The fix involved replacing execSync with execFileSync and properly handling command arguments to prevent injection attacks (GitHub Commit).

If exploited, this vulnerability could allow an attacker to execute arbitrary commands on the system where ng-packagr is being used during the build process. This could potentially lead to system compromise or unauthorized access to sensitive information.

The vulnerability can be exploited by providing malicious input through the styleIncludePaths option when using ng-packagr with LESS stylesheets. An attacker would need to have the ability to modify the build configuration or inject malicious style include paths.

Users should upgrade to ng-packagr version 10.1.1 or later which contains the fix for this vulnerability. The fix properly handles command arguments using execFileSync instead of string concatenation with execSync, preventing command injection possibilities (GitHub Commit).