{"action":"created","issue":{"url":"https://api.github.com/repos/highlightjs/highlight.js/issues/2067","repository_url":"https://api.github.com/repos/highlightjs/highlight.js","labels_url":"https://api.github.com/repos/highlightjs/highlight.js/issues/2067/labels{/name}","comments_url":"https://api.github.com/repos/highlightjs/highlight.js/issues/2067/comments","events_url":"https://api.github.com/repos/highlightjs/highlight.js/issues/2067/events","html_url":"https://github.com/highlightjs/highlight.js/issues/2067","id":463424581,"node_id":"MDU6SXNzdWU0NjM0MjQ1ODE=","number":2067,"title":"Command Injection vulnerability found in shelljs dependency","user":{"login":"Amir-61","id":10672146,"node_id":"MDQ6VXNlcjEwNjcyMTQ2","avatar_url":"https://avatars2.githubusercontent.com/u/10672146?v=4","gravatar_id":"","url":"https://api.github.com/users/Amir-61","html_url":"https://github.com/Amir-61","followers_url":"https://api.github.com/users/Amir-61/followers","following_url":"https://api.github.com/users/Amir-61/following{/other_user}","gists_url":"https://api.github.com/users/Amir-61/gists{/gist_id}","starred_url":"https://api.github.com/users/Amir-61/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Amir-61/subscriptions","organizations_url":"https://api.github.com/users/Amir-61/orgs","repos_url":"https://api.github.com/users/Amir-61/repos","events_url":"https://api.github.com/users/Amir-61/events{/privacy}","received_events_url":"https://api.github.com/users/Amir-61/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-07-02T20:37:47Z","updated_at":"2019-07-05T14:58:53Z","closed_at":null,"author_association":"NONE","body":"High severity vulnerability found in shelljs\r\nDescription: Command Injection\r\n\r\nFrom: highlight.js@9.15.5 > gear-lib@0.9.2 > jshint@2.5.11 > shelljs@0.3.0\r\n\r\nPlease see: https://github.com/shelljs/shelljs/issues/810 and https://github.com/shelljs/shelljs/pull/524#issuecomment-507152989\r\n\r\nTLDR is:\r\nThere is no security fix on shelljs; they recommendation is If you do use shell.exec(), don't pass untrusted user input (or other external values) to the function--string literals are of course the safest option.\r\n\r\nFrom: https://github.com/shelljs/shelljs/issues/810#issuecomment-356835680"},"comment":{"url":"https://api.github.com/repos/highlightjs/highlight.js/issues/comments/508785741","html_url":"https://github.com/highlightjs/highlight.js/issues/2067#issuecomment-508785741","issue_url":"https://api.github.com/repos/highlightjs/highlight.js/issues/2067","id":508785741,"node_id":"MDEyOklzc3VlQ29tbWVudDUwODc4NTc0MQ==","user":{"login":"Amir-61","id":10672146,"node_id":"MDQ6VXNlcjEwNjcyMTQ2","avatar_url":"https://avatars2.githubusercontent.com/u/10672146?v=4","gravatar_id":"","url":"https://api.github.com/users/Amir-61","html_url":"https://github.com/Amir-61","followers_url":"https://api.github.com/users/Amir-61/followers","following_url":"https://api.github.com/users/Amir-61/following{/other_user}","gists_url":"https://api.github.com/users/Amir-61/gists{/gist_id}","starred_url":"https://api.github.com/users/Amir-61/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Amir-61/subscriptions","organizations_url":"https://api.github.com/users/Amir-61/orgs","repos_url":"https://api.github.com/users/Amir-61/repos","events_url":"https://api.github.com/users/Amir-61/events{/privacy}","received_events_url":"https://api.github.com/users/Amir-61/received_events","type":"User","site_admin":false},"created_at":"2019-07-05T14:58:53Z","updated_at":"2019-07-05T14:58:53Z","author_association":"NONE","body":"I see the issue fixed in version 9.15.8. Closing this issue now."}}
{"actor":{"display_login":"Amir-61"}}