CVE-2021-23390

Description

The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the `U.set()` and `U.get()` functions.

Affected packages (1)

• npm/total4from 0, < 0.0.43

CVSS scores

References (4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-23390
• WEBhttps://github.com/totaljs/framework4/blob/master/utils.js%23L5430-L5455
• WEBhttps://github.com/totaljs/framework4/commit/8a72d8c20f38bbcac031a76a51238aa528f68821
• WEBhttps://snyk.io/vuln/SNYK-JS-TOTAL4-1130527