CVE-2020-28494

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Feb 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-284957.3This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However t CVE-2020-284967.5This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function b CVE-2020-284986.8The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no CVE-2020-284999.8All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .CVE-2020-28508.2Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Estimate and Actual Charges). Supported versions tha CVE-2020-285005.3Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions CVE-2020-285017.5This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators.CVE-2020-285028.1This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (CVE-2020-285039.8The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.CVE-2020-28517.8Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment). Supported versions that are affected CVE-2020-28528.2Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Calendar). Supported versions that ar CVE-2020-28534.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected ar