Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.
Recommended action: Upgrade to 3.4.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. In total.js framework before version 3.4.9, calling the utils.set function with user-controlled values leads to code-injection. This can cause a variety of impacts that include arbitrary code execution. This is fixed in version 3.4.9.
Recommended action: Upgrade to 3.4.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application. Affected versions of this package are vulnerable to Remote Code Execution (RCE) via `set`. PoC ```js // To be run in a nodejs console: require('total.js/utils').set({}, 'a;eval(`require("child_process")\\x2eexecSync("touch pwned")`);//') ```
Recommended action: Upgrade to 3.4.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a command injection vulnerability that affects the package total.js before version 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using childprocess.spawn. The issue occurs because childprocess.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.
Recommended action: Upgrade to 3.4.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a prototype pollution vulnerability in the package total.js before version 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection.
Recommended action: Upgrade to 3.4.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).
Recommended action: Upgrade to 3.3.0-13 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Affected versions of total.js are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files outside the /public folder by using relative paths. The files served are limited to these file types: flac, jpg, jpeg, png, gif, ico, js, css, txt, xml, woff, woff2, otf, ttf, eot, svg, zip, rar, pdf, docx, xlsx, doc, xls, html, htm, appcache, manifest, map, ogv, ogg, mp4, mp3, webp, webm, swf, package, json, md, m4v, jsx, heif, heic. Recommendation - If you are using version 2.1.x, upgrade to 2.1.1 or later. - If you are using version 2.2.x, upgrade to 2.2.1 or later. - If you are using version 2.3.x, upgrade to 2.3.1 or later. - If you are using version 2.4.x, upgrade to 2.4.1 or later. - If you are using version 2.5.x, upgrade to 2.5.1 or later. - If you are using version 2.6.x, upgrade to 2.6.3 or later. - If you are using version 2.7.x, upgrade to 2.7.1 or later. - If you are using version 2.8.x, upgrade to 2.8.1 or later. - If you are…
Recommended action: Upgrade to 3.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.