Snyk Vuln Report: Command Injection through shelljs

[corpetty]

Bug Report

Summary

Snyk.io has flagged a vulnerable module shelljs

Severity

CVSS Score: 7.0 HIGH SEVERITY

Vulnerable functions:

src.exec._exec()

• Introduced through: embark@4.0.0-beta.0 › shelljs@0.5.3
  Remediation: No remediation path available.

Overview

shelljs is a portable Unix shell commands for Node.js.

Affected version of this package are vulnerable to Command Injection. It is possible to invoke commands from shell.exec() from external sources, allowing an attacker to inject arbitrary commands.

More Info

GH issue #1
GH issue #2