Shelljs is a popular Node.js library offering a convenient way to execute common Unix shell commands within JavaScript environments, streamlining scripting and automation tasks. Comparing versions 0.5.0 and 0.5.1 reveals a subtle but important update. Both versions, authored by Artur Adib and licensed under BSD*, share identical core features including offering a portable solution to leverage familiar shell commands directly in Node.js. Developers can use commands like ls, cp, rm, mkdir, and grep with ease. The library provides cross-platform compatibility, hiding platform-specific intricacies and focusing on consistent behavior across different operating systems. The package.json for both versions also reflects the same jshint version which is a code quality tool, meaning there are no syntax or style improvements in the newer version. Although the library has no dependencies and no optional dependencies, it's crucial because it simplifies tasks like file manipulation, process execution, and handling external tools directly from Node.js applications. The key difference lies in the release date. Version 0.5.1 released on June 5, 2015, followed version 0.5.0, which was released on May 19, 2015. This indicates that version 0.5.1 likely contains bug fixes or very minor adjustments addressing issues found in the earlier 0.5.0 release. Developers should adopt the newer 0.5.1 release to ensure they benefit from the latest improvements and potentially avoid any known issues present in the previous stable version.
All the vulnerabilities related to the version 0.5.1 of the package
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec()
may be visible to other users on the same system. You may be affected if you execute shell.exec()
in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec()
as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()
) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory: