Hi @Unitech,

The issue detected is the shell.exec API, which uses child_process.exec from Node.js core internally. The issue is that one could potentially pass user-input directly to the function. In order to maintain API backwards-compatibility, we cannot change this particular method, and so we are working on introducing a new, safer API in #524.

Are your users depending on ShellJS directly, or through another dependency? If they are depending on it directly, it is enough to just not pass un-sanitized input to shell.exec. If it is through a dependency, you could make sure that shell.exec is not passed input through its API somehow. ESLint, for example, does not use shell.exec in its API, so it is safe.

Hello @freitagbr
I understand the problem. Snyk "security detection" is really too simplistic... No we do not pass anything variable to shelljs, we just use the .which method and one .exec...
Thanks for your answer

The vulnerability is known. As @freitagbr points out, it's all about how you use it. shell.exec('printf foo') is totally safe, however shell.exec('printf ' + msg) might not be.

shell.which() has no known vulnerabilities 😄