CVE-2022-0144
Improper Privilege Management in shelljs/shelljs
shelljs is vulnerable to Improper Privilege Management
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Improper Privilege Management in shelljs/shelljs
shelljs is vulnerable to Improper Privilege Management
- Record
CVE-2022-0144- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
EUVDEUVD-2022-0448
shelljs is vulnerable to Improper Privilege Management
- Record
EUVD-2022-0448- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4rq4-32rv-6wp6
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
- Record
GHSA-4rq4-32rv-6wp6- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-64g7-mvw6-v9qj No score
Improper Privilege Management in shelljs
Impact
Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.
Patches
Patched in shelljs 0.8.5
Workarounds
Recommended action is to upgrade to 0.8.5.
References
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
For more information
If you have any questions or comments about this advisory:
- Ask at https://github.com/shelljs/shelljs/issues/1058
- Open an issue at https://github.com/shelljs/shelljs/issues/new
- Record
GHSA-64g7-mvw6-v9qj- Weakness
- CWE-269
- Updated
- 2026-11-02
NVD
shelljs is vulnerable to Improper Privilege Management
- Record
CVE-2022-0144- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - CVSS 2.0
- 3.6 Low
AV:L/AC:L/Au:N/C:P/I:N/A:P - Weakness
- CWE-269
- Updated
- 2026-11-02
OSV
Improper Privilege Management in shelljs/shelljs
shelljs is vulnerable to Improper Privilege Management
- Record
CVE-2022-0144- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2022-0144
shelljs is vulnerable to Improper Privilege Management
- Record
DEBIAN-CVE-2022-0144- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-03
OSVGHSA-4rq4-32rv-6wp6
Improper Privilege Management in shelljs
shelljs is vulnerable to Improper Privilege Management
- Record
GHSA-4rq4-32rv-6wp6- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-0144
shelljs is vulnerable to Improper Privilege Management
- Record
UBUNTU-CVE-2022-0144- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - CVSS 3.0
- 7.1 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1775089657 No score
TuxCare security update for shelljs (2 CVEs)
TuxCare rebuilt shelljs to address 2 CVEs. Fixed in 0.3.0-tuxcare.1.
- Record
CLSA-2026-1775089657- Updated
- 2026-11-02
OSVCLSA-2026-1775089658 No score
TuxCare security update for shelljs (2 CVEs)
TuxCare rebuilt shelljs to address 2 CVEs. Fixed in 0.1.4-tuxcare.1.
- Record
CLSA-2026-1775089658- Updated
- 2026-11-02
OSVCLSA-2026-1784682961 No score
TuxCare security update for shelljs (2 CVEs)
TuxCare rebuilt shelljs to address 2 CVEs. Fixed in 0.8.2-tuxcare.1.
- Record
CLSA-2026-1784682961- Updated
- 2026-11-02
OSVCLSA-2026-1785291224 No score
TuxCare security update for shelljs (2 CVEs)
TuxCare rebuilt shelljs to address 2 CVEs. Fixed in 0.8.4-tuxcare.1.
- Record
CLSA-2026-1785291224- Updated
- 2026-11-02
OSVGHSA-64g7-mvw6-v9qj No score
Improper Privilege Management in shelljs
Impact
Output from the synchronous version of shell.exec() may be visible to other users on the same system. You may be affected if you execute shell.exec() in multi-user Mac, Linux, or WSL environments, or if you execute shell.exec() as the root user.
Other shelljs functions (including the asynchronous version of shell.exec()) are not impacted.
Patches
Patched in shelljs 0.8.5
Workarounds
Recommended action is to upgrade to 0.8.5.
References
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/
For more information
If you have any questions or comments about this advisory:
- Ask at https://github.com/shelljs/shelljs/issues/1058
- Open an issue at https://github.com/shelljs/shelljs/issues/new
- Record
GHSA-64g7-mvw6-v9qj- Weakness
- CWE-269
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2022-0144 No score
CVE-2022-0144 in @rootio/shelljs - Patched by Root
Root has patched CVE-2022-0144 in the @rootio/shelljs package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2022-0144- Updated
- 2026-11-02
OSVROOT-APP-NPM-GHSA-64g7-mvw6-v9qj No score
GHSA-64g7-mvw6-v9qj in @rootio/shelljs - Patched by Root
Root has patched GHSA-64g7-mvw6-v9qj in the @rootio/shelljs package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-GHSA-64g7-mvw6-v9qj- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
shelljsnpm |
before 0.8.5 | 0.8.5 |
shelljsTuxCare:npm |
0.3.0-tuxcare.0 up to 0.3.0-tuxcare.1, plus listed versions 0.3.0 |
0.3.0-tuxcare.1 |
shelljsTuxCare:npm |
0.1.4-tuxcare.0 up to 0.1.4-tuxcare.1, plus listed versions 0.1.4 |
0.1.4-tuxcare.1 |
shelljsTuxCare:npm |
0.8.2-tuxcare.0 up to 0.8.2-tuxcare.1, plus listed versions 0.8.2 |
0.8.2-tuxcare.1 |
shelljsTuxCare:npm |
0.8.4-tuxcare.0 up to 0.8.4-tuxcare.1, plus listed versions 0.8.4 |
0.8.4-tuxcare.1 |
node-shelljsDebian:12 |
before 0.8.5+~cs0.8.10-1 | 0.8.5+~cs0.8.10-1 |
node-shelljsDebian:13 |
before 0.8.5+~cs0.8.10-1 | 0.8.5+~cs0.8.10-1 |
node-shelljsDebian:14 |
before 0.8.5+~cs0.8.10-1 | 0.8.5+~cs0.8.10-1 |
@rootio/shelljsRoot:npm |
before 0.6.1-root.io.1 | 0.6.1-root.io.10.6.1-root.io.20.6.1-root.io.30.8.4-root.io.10.6.1-root.io.40.8.4-root.io.2 |
shelljsRoot:npm |
before 0.6.1-aikido.3 | 0.6.1-aikido.30.6.1-aikido.40.8.4-aikido.10.8.4-aikido.2 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
@rootio/shelljsRoot:npm |
before 0.6.1-root.io.4 | 0.6.1-root.io.40.8.4-root.io.2 |
shelljsRoot:npm |
before 0.6.1-aikido.4 | 0.6.1-aikido.40.8.4-aikido.2 |
node-shelljsUbuntu:18.04:LTS |
All versions, plus listed versions 0.7.5-1 |
None known |
node-shelljsUbuntu:20.04:LTS |
All versions, plus listed versions 0.8.3-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-0144 is a high vulnerability (CVSS 7.1) in Shelljs Shelljs/shelljs, published January 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in shelljs 0.8.5.
References
huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c
github.com/shelljs/shelljs/commit/d919d22dd6de385edaa9d90313075a77f74b338c
nvd.nist.gov/vuln/detail/CVE-2022-0144