Description

The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.

Remediation

References

https://github.com/totaljs/framework/commit/c812bbcab8981797d3a1b9993fc42dad3d246f04

https://snyk.io/vuln/SNYK-JS-TOTALJS-1077069

Related Vulnerabilities

CVE-2023-26472 Vulnerability in maven package org.xwiki.platform:xwiki-platform-icon-ui

CVE-2022-41919 Vulnerability in npm package fastify

CVE-2023-33510 Vulnerability in maven package org.jeecgframework.p3:jeecg-p3-biz-chat

CVE-2023-26144 Vulnerability in npm package graphql

CVE-2021-23555 Vulnerability in npm package vm2

Severity

Critical

Classification

CWE-94 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory Exploit