0.8.3 high severity vuln #945
Description
Node version (or tell us if you're using electron or some other framework):
Node 8+
ShellJS version (the most recent version/Github branch you see the bug on):
Operating system:
macOS
Description of the bug:
Received warnings on PM2 that shelljs got tagged for a security vulnerability.
WS-2017-3737
More information
moderate severity
Vulnerable versions: <= 0.8.3
Patched version: No fix
Shelljs 0.8.3 and before are vulnerable to Command Injection. Commands can be invoked from shell.exec(), those commands will include input from external sources, to be passed as arguments to system executables and allowing an attacker to inject arbitrary commands.