CVE-2021-23390

Description

The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the `U.set()` and `U.get()` functions.

How to fix CVE-2021-23390

To remediate CVE-2021-23390, upgrade the affected package to a fixed version below.

• npm/total4—upgrade to 0.0.43 or later

Is CVE-2021-23390 being exploited?

Low — EPSS is 1.3%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 0.0.43

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-23390
• WEBgithub.com/totaljs/framework4/blob/master/utils.js%23L5430-L5455
• WEBgithub.com/totaljs/framework4/commit/8a72d8c20f38bbcac031a76a51238aa528f68821
• WEBsnyk.io/vuln/SNYK-JS-TOTAL4-1130527