High severityNVD Advisory· Published Feb 2, 2021· Updated Sep 16, 2024
Command Injection
CVE-2020-28494
Description
This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
total.jsnpm | < 3.4.7 | 3.4.7 |
Affected products
2- total.js/total.jsdescription
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-4449-hg37-77v8ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2020-28494ghsaADVISORY
- github.com/totaljs/framework/commit/6192491ab2631e7c1d317c221f18ea613e2c18a5ghsax_refsource_MISCWEB
- snyk.io/vuln/SNYK-JS-TOTALJS-1046672ghsax_refsource_MISCWEB
- www.npmjs.com/package/total.jsghsaWEB
News mentions
0No linked articles in our index yet.