What is GHSA-g7mq-rfj2-25wq?

GHSA-g7mq-rfj2-25wq is a security advisory published by GitHub Security Advisories with Critical severity. Code Injection in total4

Which CVE IDs does GHSA-g7mq-rfj2-25wq cover?

GHSA-g7mq-rfj2-25wq covers the following CVE IDs: CVE-2021-23390. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g7mq-rfj2-25wq?

GHSA-g7mq-rfj2-25wq has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-g7mq-rfj2-25wq?

GHSA-g7mq-rfj2-25wq affects 1 product, including: npm/total4:\u003c 0.0.43.

GHSA-g7mq-rfj2-25wqCriticalCVSS 9.8

Code Injection in total4

Vendor

GitHub Security Advisories

Published

December 10, 2021

Last Modified

September 11, 2023

🔗 CVE IDs covered (1)

CVE-2021-23390 →

📋 Description

The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.

🎯 Affected products1

npm/total4:< 0.0.43

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-23390
https://github.com/totaljs/framework4/commit/8a72d8c20f38bbcac031a76a51238aa528f68821
https://github.com/totaljs/framework4/blob/master/utils.js%23L5430-L5455
https://snyk.io/vuln/SNYK-JS-TOTAL4-1130527
https://github.com/advisories/GHSA-g7mq-rfj2-25wq