ShellJS version 0.8.3 arrives as a refined iteration of its predecessor, version 0.8.2, offering developers a seamless way to execute Unix shell commands within their Node.js environments. Both versions maintain identical core dependencies, relying on glob for file matching, rechoir for flexible module loading, and interpret for handling various file extensions. This ensures consistent functionality for common tasks like file system manipulation, command execution, and stream processing.
However, the key distinction lies in the updated development dependencies. Version 0.8.3 showcases upgrades in codecov (from 1.0.1 to 3.0.2) and shelljs-release (from 0.2.0 to 0.3.0). The codecov update signals enhanced code coverage reporting, providing developers with more detailed insights into the test coverage of the library. Similarly, the shelljs-release update likely streamlines the release process for maintainers, but also potentially includes internal refactorings or improvements that might benefit users indirectly through increased stability. While seemingly minor, these improvements contribute to a more robust and maintainable library overall, benefiting developers through increased reliability and a smoother development experience. The unpacked size has slightly increased, also indicating some level of change in the code. Ultimately, upgrading to 0.8.3 is recommended to leverage the latest refinements and ensure compatibility with the evolving JavaScript ecosystem.
All the vulnerabilities related to the version 0.8.3 of the package
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory:
