Standard, a popular JavaScript style checker, saw a small but potentially impactful update with the release of version 6.0.5, following closely after 6.0.4. The core functionality of enforcing a consistent coding style remains the same, built upon the solid foundation of ESLint and a set of carefully curated rules. Both versions rely on dependencies like xtend for object extension, standard-engine for the core linting process, and various ESLint plugins such as eslint-plugin-react, eslint-plugin-promise, eslint-plugin-standard, and configuration packages (eslint-config-standard, eslint-config-standard-jsx) to ensure code quality and adherence to the Standard Style.
The key difference between the two versions lies in the specific version of the eslint dependency. Version 6.0.4 used eslint":"^2.0.0-rc.0", a release candidate, while version 6.0.5 upgrades this to a stable release with eslint":"^2.0.0". This may result in subtle changes in linting behavior, as the full, stable release of ESLint includes all fixes and changes since the release candidate. Developers should ensure compatibility and re-lint their projects after upgrading to account for these refinements. The change to a stable ESLint should generally suggest more predictable linting behavior and reduced risk of unexpected issues. The other dependencies, including development dependencies used for testing and building remain the same between versions.
All the vulnerabilities related to the version 6.0.5 of the package
Prototype Pollution in Ajv
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
Improper Privilege Management in shelljs
Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.
Patched in shelljs 0.8.5
Recommended action is to upgrade to 0.8.5.
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
If you have any questions or comments about this advisory:
