OS Command Injection in ng-packagr

MEDIUM 6.6CVE-2020-7735 · GHSA-qm28-7hqv-wg5j · SNYK-JS-NGPACKAGR-1012427 · Published 25/09/2020 · updated 17/06/2026

In short

CVE-2020-7735 is a MEDIUM (CVSS 6.6) vulnerability affecting ng-packagr (ng-packagr project), ng-packagr.
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 84.1% of all vulnerabilities.
Fix: update to 10.1.1 or later.

Package	Affected versions	Patched versions
ng-packagr ng-packagr_project	`< 10.1.1`	`10.1.1`
ng-packagr npm	`< 10.1.1`	`10.1.1`

The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.

NVD description

The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.