GHSA-64g7-mvw6-v9qj

Suggest an improvement
Source
https://github.com/advisories/GHSA-64g7-mvw6-v9qj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-64g7-mvw6-v9qj/GHSA-64g7-mvw6-v9qj.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-64g7-mvw6-v9qj
Downstream
CLSA (4)
ROOT (1)
Published
2022-01-14T21:09:50Z
Modified
2022-01-14T20:50:57Z
Summary
Improper Privilege Management in shelljs
Details

Impact

Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.

Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.

Patches

Patched in shelljs 0.8.5

Workarounds

Recommended action is to upgrade to 0.8.5.

References

https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/

For more information

If you have any questions or comments about this advisory:

Database specific 
{
    "cwe_ids":  [
        "CWE-269"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-01-14T20:50:57Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

npm / shelljs

Package

Name
shelljs
View open source insights on deps.dev
Purl
pkg:npm/shelljs

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.8.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-64g7-mvw6-v9qj/GHSA-64g7-mvw6-v9qj.json"