CVE-2020-28494
published 2021-02-02CVE-2020-28494: This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command…
PriorityP350high8.6CVSS 3.1
AVNACLPRNUINSUCHILAL
EPSS
1.70%
74.4th percentile
This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| totaljs | total.js | < 3.4.7 | 3.4.7 |
| totaljs | total.js | >= 0 < 3.4.7 | 3.4.7 |
| totaljs | total.js | >= unspecified < 3.4.7 | 3.4.7 |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Command injection in total.js
ghsa·2021-02-05
CVE-2020-28494 [HIGH] CWE-78 Command injection in total.js
Command injection in total.js
There is a command injection vulnerability that affects the package total.js before version 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.
OSV
Command injection in total.js
osv·2021-02-05
CVE-2020-28494 [HIGH] Command injection in total.js
Command injection in total.js
There is a command injection vulnerability that affects the package total.js before version 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-02-02
Published