Shelljs is a lightweight utility that brings the power of Unix shell commands to Node.js environments, allowing developers to execute common system commands directly from their JavaScript code. Versions 0.0.2 and 0.0.3, both authored by Artur Adib, offer this functionality, providing a way to automate shell tasks, manipulate files, and interact with the operating system through a familiar and portable API. Both versions share a similar foundation, with no declared dependencies or development dependencies, suggesting a focus on simplicity and a small footprint. The core functionality remains consistent, aiming to provide a seamless integration of shell commands within Node.js applications.
The key difference between version 0.0.2 and 0.0.3 appears to be the release date. Version 0.0.3 was released on March 21, 2012, approximately six days after version 0.0.2, which was released on March 15, 2012. This suggests that version 0.0.3 likely includes bug fixes, minor enhancements, or small adjustments over its predecessor. This rapid iteration implies a commitment to stability and refinement early in the project's lifecycle. For developers, upgrading to version 0.0.3 would generally be recommended to benefit from any potential improvements or resolutions of minor issues present in version 0.0.2. While the specifics of these changes require deeper investigation, the updated release date points to a slightly more mature and potentially more reliable version for incorporating shell functionality into Node.js projects.
All the vulnerabilities related to the version 0.0.3 of the package
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory:
