{"id":"CVE-2022-0144","aliases":["CLSA-2026-1775089657","CLSA-2026-1775089658","CLSA-2026-1784682961","CLSA-2026-1785291224","DEBIAN-CVE-2022-0144","EUVD-2022-0448","GHSA-4rq4-32rv-6wp6","GHSA-64g7-mvw6-v9qj","ROOT-APP-NPM-CVE-2022-0144","ROOT-APP-NPM-GHSA-64g7-mvw6-v9qj","UBUNTU-CVE-2022-0144"],"status":"published","title":"Improper Privilege Management in shelljs/shelljs","description":"shelljs is vulnerable to Improper Privilege Management","severity":{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0046,"percentile":0.40098,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2022-01-11T06:45:10Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"npm","package":"shelljs","fixed_in":["0.8.5"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"shelljs","fixed_in":["0.3.0-tuxcare.1","0.1.4-tuxcare.1","0.8.2-tuxcare.1","0.8.4-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-shelljs","fixed_in":["0.8.5+~cs0.8.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-shelljs","fixed_in":["0.8.5+~cs0.8.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-shelljs","fixed_in":["0.8.5+~cs0.8.10-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/shelljs","fixed_in":["0.6.1-root.io.1","0.6.1-root.io.2","0.6.1-root.io.3","0.8.4-root.io.1","0.6.1-root.io.4","0.8.4-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"shelljs","fixed_in":["0.6.1-aikido.3","0.6.1-aikido.4","0.8.4-aikido.1","0.8.4-aikido.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"shelljs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"shelljs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.5"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"shelljs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.0-tuxcare.0"},{"fixed":"0.3.0-tuxcare.1"}]}],"versions":["0.3.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"shelljs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.4-tuxcare.0"},{"fixed":"0.1.4-tuxcare.1"}]}],"versions":["0.1.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"shelljs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.2-tuxcare.0"},{"fixed":"0.8.2-tuxcare.1"}]}],"versions":["0.8.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"shelljs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.4-tuxcare.0"},{"fixed":"0.8.4-tuxcare.1"}]}],"versions":["0.8.4"]},{"source":"osv","ecosystem":"Debian:12","package":"node-shelljs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.5+~cs0.8.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-shelljs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.5+~cs0.8.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-shelljs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.5+~cs0.8.10-1"}]}]},{"source":"osv","ecosystem":"npm","package":"shelljs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.8.5"}]}]},{"source":"osv","ecosystem":"npm","package":"shelljs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.8.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/shelljs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-root.io.1"},{"fixed":"0.6.1-root.io.2"},{"fixed":"0.6.1-root.io.3"},{"fixed":"0.8.4-root.io.1"},{"fixed":"0.6.1-root.io.4"},{"fixed":"0.8.4-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"shelljs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-aikido.3"},{"fixed":"0.6.1-aikido.4"},{"fixed":"0.8.4-aikido.1"},{"fixed":"0.8.4-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/shelljs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-root.io.4"},{"fixed":"0.8.4-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"shelljs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-aikido.4"},{"fixed":"0.8.4-aikido.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-shelljs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.5-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-shelljs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1"]}],"products":[{"vendor":"shelljs","product":"shelljs/shelljs"},{"vendor":"shelljs_project","product":"shelljs"}],"references":[{"url":"https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Third Party Advisory","web","report"]},{"url":"https://github.com/shelljs/shelljs/commit/d919d22dd6de385edaa9d90313075a77f74b338c","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0144","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4rq4-32rv-6wp6"},{"url":"https://github.com/shelljs/shelljs/security/advisories/GHSA-64g7-mvw6-v9qj","tags":["web"]},{"url":"https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/","tags":["report"]},{"url":"https://github.com/advisories/GHSA-64g7-mvw6-v9qj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0144.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-0144","tags":["advisory"]},{"url":"https://github.com/shelljs/shelljs","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2022-0144","tags":["report"]},{"url":"https://github.com/shelljs/shelljs/issues/1058","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0144","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-0144","title":"Improper Privilege Management in shelljs/shelljs","description":"shelljs is vulnerable to Improper Privilege Management","status":"published","published":"2022-01-11T06:45:10Z","modified":"2026-10-08T21:24:19.74Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:34:41.34666Z"}],"euvd":[{"id":"EUVD-2022-0448","description":"shelljs is vulnerable to Improper Privilege Management","status":"published","published":"2022-01-11T06:45:10Z","modified":"2026-10-08T21:24:19Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:25.942984Z"}],"ghsa":[{"id":"GHSA-4rq4-32rv-6wp6","title":"Improper Privilege Management in shelljs","description":"shelljs is vulnerable to Improper Privilege Management","status":"published","published":"2022-01-21T23:37:28Z","modified":"2023-11-29T22:21:11Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:37:23.843848Z"},{"id":"GHSA-64g7-mvw6-v9qj","title":"Improper Privilege Management in shelljs","description":"### Impact\nOutput from the synchronous version of `shell.exec()` may be visible to other users on the same system. You may be affected if you execute `shell.exec()` in multi-user Mac, Linux, or WSL environments, or if you execute `shell.exec()` as the root user.\n\nOther shelljs functions (including the asynchronous version of `shell.exec()`) are not impacted.\n\n### Patches\nPatched in shelljs 0.8.5\n\n### Workarounds\nRecommended action is to upgrade to 0.8.5.\n\n### References\nhttps://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Ask at https://github.com/shelljs/shelljs/issues/1058\n* Open an issue at https://github.com/shelljs/shelljs/issues/new\n","status":"published","published":"2022-01-14T21:09:50Z","modified":"2023-01-11T05:03:39Z","cwes":["CWE-269"],"updated_at":"2026-11-02T14:36:12.361159Z"}],"nvd":[{"id":"CVE-2022-0144","description":"shelljs is vulnerable to Improper Privilege Management","status":"published","published":"2022-01-11T07:15:07.26Z","modified":"2026-10-08T22:17:14.54Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":3.6,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:07:10.836864Z"}],"osv":[{"id":"CVE-2022-0144","title":"Improper Privilege Management in shelljs/shelljs","description":"shelljs is vulnerable to Improper Privilege Management","status":"published","published":"2022-01-11T06:45:10Z","modified":"2026-10-28T02:31:14.48802809Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"DEBIAN-CVE-2022-0144","description":"shelljs is vulnerable to Improper Privilege Management","status":"published","published":"2022-01-11T07:15:07.26Z","modified":"2026-11-03T08:00:51.014037316Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"GHSA-4rq4-32rv-6wp6","title":"Improper Privilege Management in shelljs","description":"shelljs is vulnerable to Improper Privilege Management","status":"published","published":"2022-01-21T23:37:28Z","modified":"2023-11-08T04:07:28.854274Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"UBUNTU-CVE-2022-0144","description":"shelljs is vulnerable to Improper Privilege Management","status":"published","published":"2022-01-11T07:15:00Z","modified":"2025-10-24T04:52:47Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"CLSA-2026-1775089657","title":"TuxCare security update for shelljs (2 CVEs)","description":"TuxCare rebuilt shelljs to address 2 CVEs. Fixed in 0.3.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:19Z","modified":"2026-10-15T09:47:49.406741093Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775089658","title":"TuxCare security update for shelljs (2 CVEs)","description":"TuxCare rebuilt shelljs to address 2 CVEs. Fixed in 0.1.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:20Z","modified":"2026-10-15T09:47:49.352192947Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1784682961","title":"TuxCare security update for shelljs (2 CVEs)","description":"TuxCare rebuilt shelljs to address 2 CVEs. Fixed in 0.8.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:46Z","modified":"2026-10-15T09:47:54.079447829Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785291224","title":"TuxCare security update for shelljs (2 CVEs)","description":"TuxCare rebuilt shelljs to address 2 CVEs. Fixed in 0.8.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:47:37.698204695Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"GHSA-64g7-mvw6-v9qj","title":"Improper Privilege Management in shelljs","description":"### Impact\nOutput from the synchronous version of `shell.exec()` may be visible to other users on the same system. You may be affected if you execute `shell.exec()` in multi-user Mac, Linux, or WSL environments, or if you execute `shell.exec()` as the root user.\n\nOther shelljs functions (including the asynchronous version of `shell.exec()`) are not impacted.\n\n### Patches\nPatched in shelljs 0.8.5\n\n### Workarounds\nRecommended action is to upgrade to 0.8.5.\n\n### References\nhttps://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Ask at https://github.com/shelljs/shelljs/issues/1058\n* Open an issue at https://github.com/shelljs/shelljs/issues/new\n","status":"published","published":"2022-01-14T21:09:50Z","modified":"2022-01-14T20:50:57Z","cwes":["CWE-269"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"ROOT-APP-NPM-CVE-2022-0144","title":"CVE-2022-0144 in @rootio/shelljs - Patched by Root","description":"Root has patched CVE-2022-0144 in the @rootio/shelljs package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-10T12:09:53Z","modified":"2026-07-10T19:32:19.591642522Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"ROOT-APP-NPM-GHSA-64g7-mvw6-v9qj","title":"GHSA-64g7-mvw6-v9qj in @rootio/shelljs - Patched by Root","description":"Root has patched GHSA-64g7-mvw6-v9qj in the @rootio/shelljs package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-10T12:09:53Z","modified":"2026-07-10T19:33:07.146124462Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}