critical9.8
CVE-2021-23390
Code Injection in total4
Impact
The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the `U.set()` and `U.get()` functions.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | total4 | < 0.0.43 | 0.0.43 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Totaljs | Total4 | before 0.0.43 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/totaljs/framework4/blob/master/utils.js%23L5430-L5455
- https://github.com/totaljs/framework4/commit/8a72d8c20f38bbcac031a76a51238aa528f68821
- https://snyk.io/vuln/SNYK-JS-TOTAL4-1130527
- https://github.com/advisories/GHSA-g7mq-rfj2-25wq
- https://nvd.nist.gov/vuln/detail/CVE-2021-23390