Description
The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.
Remediation
References
https://github.com/totaljs/framework/commit/c812bbcab8981797d3a1b9993fc42dad3d246f04
https://snyk.io/vuln/SNYK-JS-TOTALJS-1077069
Related Vulnerabilities
CVE-2022-35980 Vulnerability in maven package org.opensearch.plugin:opensearch-security
CVE-2022-24802 Vulnerability in npm package deepmerge-ts
CVE-2022-0868 Vulnerability in npm package urijs
CVE-2023-44487 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2023-34454 Vulnerability in maven package org.xerial.snappy:snappy-java