ShellJS is a popular Node.js library providing portable Unix shell commands, simplifying cross-platform scripting. Comparing versions 0.7.2 and 0.7.3, the core functionality and dependencies remain consistent, indicating a focus on stability and incremental improvements. Both versions share identical dependencies: glob for file pattern matching, rechoir for loading configuration files, and interpret for interpreting different file types. Similarly, their development dependencies for linting, release management, changelog generation, and CI integration are also the same. This suggests the underlying toolchain and quality control processes haven't changed between these versions.
The key difference lies in the version and releaseDate. Version 0.7.3 was released on July 27, 2016, a couple of days after version 0.7.2 (released on July 25, 2016). This points to a potential bug fix, minor feature addition, or documentation update addressed in the newer version. Developers should always prioritize using the latest stable release (0.7.3 in this case) to benefit from the most up-to-date code and potential improvements. While the changelog is not provided in the data, checking the official ShellJS repository on GitHub for the specific changelog entries between these versions would be beneficial for developers seeking detailed information on the exact changes. ShellJS remains a valuable tool for Node.js developers seeking to streamline shell scripting and enhance cross-platform compatibility within their projects.
All the vulnerabilities related to the version 0.7.3 of the package
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory:
