What is GHSA-7fm6-gxqg-2pwr?

GHSA-7fm6-gxqg-2pwr is a security advisory published by GitHub Security Advisories with Critical severity. Code Injection in total.js

Which CVE IDs does GHSA-7fm6-gxqg-2pwr cover?

GHSA-7fm6-gxqg-2pwr covers the following CVE IDs: CVE-2021-23389. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7fm6-gxqg-2pwr?

GHSA-7fm6-gxqg-2pwr has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-7fm6-gxqg-2pwr?

GHSA-7fm6-gxqg-2pwr affects 1 product, including: npm/total.js:\u003c 3.4.9.

GHSA-7fm6-gxqg-2pwrCriticalCVSS 9.8

Code Injection in total.js

Vendor

GitHub Security Advisories

Published

December 10, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-23389 →

📋 Description

The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.

🎯 Affected products1

npm/total.js:< 3.4.9

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-23389
https://github.com/totaljs/framework/commit/887b0fa9e162ef7a2dd9cec20a5ca122726373b3
https://github.com/totaljs/framework/blob/master/utils.js%23L6606-L6631
https://snyk.io/vuln/SNYK-JS-TOTALJS-1088607
https://github.com/advisories/GHSA-7fm6-gxqg-2pwr