Shelljs, a Node.js library providing portable Unix shell commands, saw a minor version update from 0.0.5 to 0.0.6. Both versions maintain the core description of offering Unix shell functionalities within a Node.js environment, enabling developers to execute common shell operations directly from their JavaScript code. The key difference lies in the release date and likely bug fixes or minor enhancements incorporated in the newer version. While both versions lack declared dependencies, development dependencies, or optional dependencies, indicating a lightweight and self-contained nature, developers should prefer version 0.0.6 due to its recency, assuming it addresses issues or introduces subtle improvements over version 0.0.5.
For developers, Shelljs offers the convenience of avoiding direct system calls for shell commands, streamlining cross-platform scripting within Node.js applications. The absence of declared dependencies simplifies integration minimizing dependency conflicts. The library is best suited for tasks such as automating build processes, interacting with the file system, or executing external commands, making it valuable for development workflows, build tools, and system administration scripts. It is available via npm and can be easily integrated into projects. The library's focus on portability increases scripts reusability across different operating systems.
All the vulnerabilities related to the version 0.0.6 of the package
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec()
may be visible to other users on the same system. You may be affected if you execute shell.exec()
in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec()
as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()
) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory: