Trying to get in touch regarding a security issue

Hey there!

I belong to an open source security research community, and a member (@haxatron) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

[nfischer]

Thanks for the report. I believe this is a valid issue in ShellJS, so I’ve created a fix and pushed a release.

• The patch for this is https://github.com/shelljs/shelljs/pull/1060. That PR landed on tip-of-tree (master branch), however I also cherrypicked this onto the 0.8-release branch.
• This fix was released in 0.8.5. The patch for this bug is the only change between 0.8.4 and 0.8.5.
• I’m trying to figure out a nice way to edit the CHANGELOG.md to explain what went into these two versions, but this doesn’t work well with the tool we use to automate changelog generation. I’ll need to think a bit more about how to mix manual edits with autogenerated changelog.
• I added a SECURITY.md in https://github.com/shelljs/shelljs/pull/1061. For future reference, the best way to get in contact with me for security issues is with the email address in that page.

If you believe this patch is insufficient, please let me know privately via email and I’ll gladly investigate further.

[nfischer]

The report should be public now. I recommend folks upgrade to ShellJS 0.8.5 to ensure you have the fix.

This bug only impacts the synchronous version of shell.exec(). All other ShellJS methods (including the async usage of shell.exec()) should not be impacted, however it’s of course perfectly safe to update ShellJS anyway.