CVE-2020-28494

Katalog CVE

CVSS 8.6 · High EPSS 1,7%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada totaljs total.js. Skor CVSS 3.1 8.6 (High) menurut snyk.io.

Deskripsi (NVD)

This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.

Rincian

Terbit di NVD

2 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.6 (High), sumber snyk.io
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/totaljs/framework/commit/6192491ab2631e7c1d317c221f18ea613e2c18a5 patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-TOTALJS-1046672 exploit · patch · advisory pihak ketiga