shelljs is a portable Unix shell commands for Node.js. It is possible to invoke commands from shell.exec() from external sources, allowing an attacker to inject arbitrary commands. References: https://snyk.io/vuln/npm:shelljs:20140723 Upstream bugs: https://github.com/shelljs/shelljs/issues/143 https://github.com/shelljs/shelljs/issues/495 Upstream patch: https://github.com/shelljs/shelljs/pull/524/commits/2f18dc4e4cbbc1d22d9e80ed8ce9d222db0b62f5
Created nodejs-shelljs tracking bugs for this issue: Affects: epel-all [bug 1425810] Affects: fedora-all [bug 1425809]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.