~ / search / GHSA-7fm6-gxqg-2pwr

GHSA-7fm6-gxqg-2pwr

Code Injection in total.js

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-23389

Packages

EcosystemPackageAffectedFixed in
npm total.js < 3.4.9 3.4.9

Details

As written in the advisory (Markdown source, shown as plain text).

The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.

References

External links from the advisory. They lead to third-party sites.