Vulnerability · Published Feb 2, 2021 · Assigned by snyk
CVE-2020-28494Command Injection
High 8.6
In plain English
A high-severity security flaw in total.js. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)1.7%top 22.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | total.js | 3.4.7 | GHSA-4449-hg37-77v8 |
Affected products (as reported)
References
- https://snyk.io/vuln/SNYK-JS-TOTALJS-1046672 x_refsource_MISC
- https://github.com/totaljs/framework/commit/6192491ab2631e7c1d317c221f18ea613e2c18a5 x_refsource_MISC