Improper Privilege Management in node-shelljs Package - CVE-2022-0144
Summary
UBUNTU-CVE-2022-0144: shelljs is vulnerable to Improper Privilege Management. Affects node-shelljs versions 0.7.5-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-shelljs package is a popular utility for executing shell commands in Node.js applications. It provides a simple and consistent API for shell command execution, making it easier for developers to integrate shell commands into their JavaScript code. However, this package has been found to have a vulnerability that could lead to improper privilege management, potentially allowing unauthorized access to sensitive operations.
Vulnerability Detail
The vulnerability identified as CVE-2022-0144 in the node-shelljs package stems from improper privilege management. This issue allows attackers to exploit the package to gain elevated privileges, which can lead to unauthorized access to system resources or sensitive data. The vulnerability affects versions 0.7.5-1 and 0.8.3-1 of the package in Ubuntu distributions. The CVSS score for this vulnerability is 7.1, indicating a high severity level that necessitates immediate attention.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate upgrade is not feasible, consider restricting access to the affected systems and monitoring for any suspicious activity. Additionally, avoid using the vulnerable versions of node-shelljs in critical applications until the package is updated.
Conclusion
The node-shelljs package has a critical vulnerability (CVE-2022-0144) that can lead to improper privilege management. It is essential to update to a patched version to mitigate risks associated with this vulnerability. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for node-shelljs →
FAQ
CVE-2022-0144 is a vulnerability in the node-shelljs package that allows for improper privilege management, potentially leading to unauthorized access.
The affected versions are 0.7.5-1 for Ubuntu 18.04 LTS and 0.8.3-1 for Ubuntu 20.04 LTS.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot upgrade, restrict access to the affected systems and monitor for any suspicious activity as a temporary measure.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for node-shelljs.
