WS-2016-0039 High Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

WS-2016-0039 - High Severity Vulnerability

Vulnerable Library - shell-quote-0.0.1.tgz

quote and parse shell commands

path: /tmp/git/JSHint/node_modules/jshint/node_modules/shell-quote/package.json

Library home page: http://registry.npmjs.org/shell-quote/-/shell-quote-0.0.1.tgz

Dependency Hierarchy:

• browserify-9.0.8.tgz (Root Library)
  • ❌ shell-quote-0.0.1.tgz (Vulnerable Library)

Vulnerability Details

The npm module "shell-quote" cannot correctly escape "greater than" and "lower than" operator used for redirection in shell. This might be possible vulnerability for many application which depends on shell-quote.

Publish Date: 2016-06-21

URL: WS-2016-0039

CVSS 2 Score Details (8.4)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/117

Release Date: 2016-06-21

Fix Resolution: Upgrade to at least version 1.6.1

---

Step up your Open Source Security Game with WhiteSource here