Shelljs version 0.7.6 introduces notable improvements over its predecessor, version 0.7.5. Both versions offer a portable way to execute Unix shell commands within Node.js environments, simplifying cross-platform scripting and automation. The core dependencies, including "glob," "rechoir," and "interpret," remain consistent, ensuring continued compatibility and functionality for existing users. However, version 0.7.6 incorporates new development dependencies: "ava" for enhanced testing capabilities, "nyc" for code coverage analysis, and "shx" which provides cross-platform shell commands for use in npm package scripts. These additions suggest an increased focus on code quality and maintainability in the newer release.
Developers upgrading to 0.7.6 can benefit from the improved testing framework "ava" and gain better insights into code coverage using "nyc," leading to more robust and reliable shell scripts. The inclusion of "shx" streamlines build processes and cross-platform compatibility during development. While the core functionality of shelljs remains unchanged, the updated toolchain provides a more efficient and reliable experience for developers. Both versions are licensed under BSD-3-Clause, ensuring open source use and modification rights. Developers who need more robust testing and cross-platform tools in their CI/CD pipelines, should consider upgrading to version 0.7.6 to capitalize on these enhancements.
All the vulnerabilities related to the version 0.7.6 of the package
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory:
