ShellJS version 0.7.1 introduces several improvements over its predecessor, version 0.7.0, catering to developers seeking a more robust and streamlined experience when executing Unix shell commands within Node.js environments. Both versions maintain the core functionality of providing a portable, cross-platform shell interface, simplifying tasks like file manipulation, directory navigation, and process execution. The key dependencies, glob, rechoir, and interpret, remain consistent, ensuring compatibility and consistent project configuration loading.
However, the notable difference lies in the development dependencies. Version 0.7.1 upgrades its development tooling, notably including shelljs-release, shelljs-changelog, and travis-check-changes to automate the release process and enforce quality checks. Prior to this, ShellJS relied on older versions of development tools such as jshint. While jshint remains, the additions suggest a greater focus on release automation, comprehensive changelog generation, and continuous integration checks through Travis CI. This enhanced tooling benefits developers by ensuring that contributions from the community maintain a higher standard of consistency and ease the process of publishing new versions.
For developers adopting ShellJS 0.7.1, this translates into more reliable updates, better documented changes, and greater trust in the library's stability. The core functionality largely stays the same, providing Node.js developers with familiar Unix commands, but the improved release pipeline contributes to a more robust and well-maintained package.
All the vulnerabilities related to the version 0.7.1 of the package
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec()
may be visible to other users on the same system. You may be affected if you execute shell.exec()
in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec()
as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()
) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory: