CVE-2020-28494

Name of the Vulnerable Software and Affected Versions: total.js versions prior to 3.4.7

Description: The issue occurs in the image.pipe and image.stream functions due to the type parameter being used to build a command that is executed using child process.spawn with the option shell set to true, and because the type parameter is not properly sanitized. This leads to a command injection vulnerability.

Recommendations: For versions prior to 3.4.7, update to version 3.4.7 or later to resolve the issue. As a temporary workaround, consider disabling the image.pipe and image.stream functions until a patch is available. Restrict access to these functions to minimize the risk of exploitation. Avoid using the type parameter in the affected functions until the issue is resolved.