Shelljs, a popular Node.js library providing cross-platform Unix shell commands, saw a significant update between versions 0.6.1 and 0.7.0. The core functionality of providing a portable way to execute shell commands in Node.js applications remains the same, allowing developers to easily script system-level tasks within their JavaScript code. However, version 0.7.0 introduces key dependencies, notably glob, rechoir, and interpret. This addition likely impacts how Shelljs handles file system interactions and configuration. The inclusion of glob suggests enhanced file matching capabilities, crucial for tasks like finding files based on patterns. rechoir and interpret indicate a more flexible way of handling configuration files, possibly allowing Shelljs to be configured using different file formats like JSON, YAML, or CoffeeScript.
Developers upgrading from 0.6.1 should be aware of these new dependencies, as they could affect the library's footprint and potentially introduce new behavior. These changes likely aim to improve the library's versatility and configuration options. Conversely, version 0.6.1 has no dependencies, making it a lighter option if these additional features are unnecessary. Despite the added dependencies, both versions retain the same core purpose: simplifying shell scripting within Node.js, offering a convenient alternative to writing platform-specific code for common command-line operations. Both versions have similar development dependencies, useful for contributing to the project. The later version offers an upgrade to the internal implementations, that are required for some use cases.
All the vulnerabilities related to the version 0.7.0 of the package
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec()
may be visible to other users on the same system. You may be affected if you execute shell.exec()
in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec()
as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()
) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory: