CVE-2020-28494

Summary: CVE-2020-28494 affects the total.js package (before 3.4.7). The vulnerability occurs in the image.pipe and image.stream functions where the type parameter is used to build a command that is executed via child_process.spawn with the option shell: true, and the type value is not properly s...

@pl-test/c (>=1.1.0, <=1.1.1), @pl-test/e (1.1.0) potentially affected by CVE-2020-28494 via total.js (3.2.4)

total.js NPM version 3.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on total.js and may be impacted: - @pl-test/c =1.1.0, =1.1.1 - @pl-test/e 1.1.0 Source cves: CVE-2020-28494 Source advisory: SNYK:JS-TOTALJS-1046672...