CVE-2022-0144: 
JavaScript vulnerability analysis and mitigation

A vulnerability was identified in the ShellJS library (CVE-2022-0144) related to improper privilege management when using the exec function. The issue was discovered and disclosed in January 2022, affecting systems using the ShellJS library (CVE Mitre, Red Hat Portal).

The vulnerability stems from improper file permissions management in the internal implementation of shell.exec(). The issue specifically relates to how the function handles file permissions for temporary files used during command execution, which could potentially expose sensitive information (GitHub Commit).

The vulnerability could allow local users on the filesystem to access sensitive information. This includes the potential exposure of command output and parameters used in exec() function calls (Red Hat Portal).

A fix was implemented that locks down file permissions used by the internal implementation of shell.exec(). The solution includes creating files with restricted permissions (mode 600) that are locked down for read and write access to the current user only (GitHub Commit).