Shelljs is a popular Node.js library providing a suite of portable Unix shell commands that can be executed within JavaScript. Version 0.5.2 builds upon the foundation laid by its predecessor, version 0.5.1, offering developers a potentially more refined and stable experience. While the core functionality and dependencies remain consistent, subtle improvements and bug fixes likely distinguish the two versions.
Both versions share the same core characteristics: facilitating the execution of common shell operations like file manipulation, directory navigation, and command execution directly from Node.js scripts. This eliminates the need for external shell scripts, simplifying development workflows and enhancing portability across different operating systems. Version 0.5.1 was released on June 5, 2015 and version 0.5.2 was released on August 10, 2015.
Developers considering adopting Shelljs or upgrading from version 0.5.1 to 0.5.2 should be aware of the potential benefits. Although the provided metadata doesn't explicitly detail the changes, the difference in release dates indicate some potential difference. Given the patch version increment (0.5.1 to 0.5.2), the changes are likely focused on resolving bugs, improving performance, or enhancing compatibility without introducing major new features. Checking the changelog or release notes associated with version 0.5.2 on the Shelljs GitHub repository would provide definitive insights into the specific modifications implemented.
All the vulnerabilities related to the version 0.5.2 of the package
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory:
