Description

The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.

Remediation

References

https://github.com/totaljs/framework/commit/c812bbcab8981797d3a1b9993fc42dad3d246f04

https://snyk.io/vuln/SNYK-JS-TOTALJS-1077069

Related Vulnerabilities

CVE-2023-48711 Vulnerability in npm package google-translate-api-browser

CVE-2022-0613 Vulnerability in npm package urijs

CVE-2020-7751 Vulnerability in npm package pathval

CVE-2021-32623 Vulnerability in maven package org.opencastproject:opencast-kernel

CVE-2021-35513 Vulnerability in npm package mermaid

Severity

Critical

Classification

CWE-94 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory Exploit