Shelljs version 0.7.5 offers a refined iteration of the widely-used shelljs library, designed for executing Unix shell commands within Node.js environments. Comparing it to the prior stable release, version 0.7.4, reveals minimal yet potentially impactful modifications, primarily evidenced by the releaseDate field that reflects a more recent build timestamp. Both versions maintain the same core dependencies on essential utilities like glob (for file pattern matching), rechoir (for extending require), and interpret (for file interpretation). Similarly, the devDependencies remain consistent, indicating an unchanged testing and development environment utilizing tools such as eslint (for code linting), coffee-script (for CoffeeScript support), shelljs-release and shelljs-changelog (for release management), eslint-plugin-import (for ES6 import syntax validation), travis-check-changes (for CI integration), and eslint-config-airbnb-base (for Airbnb's Javascript style guide); This suggests the core functionality and development practices remain stable.
The absence of alterations in dependencies and devDependencies hints that version 0.7.5 likely focuses on bug fixes, performance enhancements, or documentation updates. Developers should prioritize reviewing the changelog or release notes associated with version 0.7.5 to identify the specific improvements and determine if upgrading from 0.7.4 is warranted based on their project's needs. If the library is working as intended, consider not updating at all but make sure to check for vulnerabilities consistently. Shelljs simplifies the automation of shell tasks in JavaScript, crucial for build processes, system administration, and cross-platform scripting. The BSD-3-Clause license grants developers flexibility in integrating shelljs into various projects.
All the vulnerabilities related to the version 0.7.5 of the package
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory:
