Shelljs, a versatile Node.js library offering portable Unix shell commands, saw a minor version update from 0.1.0 to 0.1.1. While both versions share the core functionality of providing a cross-platform, JavaScript interface to common shell utilities, the latter offers subtle improvements for developers. Both versions boast no external dependencies, simplifying integration into existing projects. Developers familiar with Unix commands like ls, cp, rm, mkdir, and grep will find Shelljs a natural fit, enabling them to script system-level tasks directly within their Node.js applications.
The update from 0.1.0 to 0.1.1, released on January 1, 2013 (a few days from the prior release date of December 26, 2012), although seemingly small, likely addressed bug fixes, performance enhancements, or minor API refinements. Given the absence of explicit dependency changes, the focus was probably on stabilizing and optimizing the existing feature set. Developers should note the concise API and direct mapping to shell commands, which allows for rapid prototyping and scripting of build processes, file system manipulations, and other system-level operations without resorting to platform-specific code. To understand specific code changes, inspecting the commit history on the linked GitHub repository is advisable.
This makes code cross platform and easier to test.
All the vulnerabilities related to the version 0.1.1 of the package
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory:
