Shelljs, a Node.js library designed to bring the power of Unix shell commands to JavaScript developers, saw a notable evolution between versions 0.0.1 and 0.0.2. While both versions aimed to provide a portable way to execute common shell tasks, the subtle changes reflect the library's early development. Version 0.0.2, released on March 15, 2012, builds upon the initial foundation laid by version 0.0.1, which was launched on March 2, 2012.
One key difference lies in the project's repository. Version 0.0.1 pointed to a repository named "shell.js" on GitHub, whereas version 0.0.2 moved to "shelljs," indicating a standardization of the project's name across platforms. This seemingly small change can simplify dependency management and improve discoverability for developers.
Furthermore, the description in version 0.0.2 explicitly states "Portable Unix shell commands," reinforcing the library's cross-platform ambitions beyond just Unix systems. This emphasis hints at the evolving vision for shelljs as a versatile tool for developers working on diverse environments. Both versions, authored by Artur Adib, list no dependencies, meaning developers can readily integrate shelljs into their projects without worrying about complex dependency trees. The direct tarball download links provided in each version ensure easy access and installation via npm. For developers seeking a lightweight and straightforward way to execute shell commands within their Node.js applications, shelljs, especially version 0.0.2 with its focus on portability, offered a promising early solution.
All the vulnerabilities related to the version 0.0.2 of the package
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory:
