~ / search / GHSA-g7mq-rfj2-25wq

GHSA-g7mq-rfj2-25wq

Code Injection in total4

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-23390

Packages

EcosystemPackageAffectedFixed in
npm total4 < 0.0.43 0.0.43

Details

As written in the advisory (Markdown source, shown as plain text).

The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the `U.set()` and `U.get()` functions.

References

External links from the advisory. They lead to third-party sites.