CVE-2020-28494: 
JavaScript vulnerability analysis and mitigation

The vulnerability CVE-2020-28494 affects the total.js package versions before 3.4.7. The issue was discovered in the image.pipe and image.stream functions, where the type parameter is used to build commands that are executed using child_process.spawn. The vulnerability was disclosed on January 29, 2021 (Snyk Report).

The vulnerability occurs because child_process.spawn is called with the option shell set to true and the type parameter is not properly sanitized. This implementation flaw allows for potential command injection attacks. The vulnerability has been assigned a CVSS v3.1 score of 8.6 (HIGH) by Snyk, indicating significant severity (Snyk Report).

A successful exploitation of this vulnerability could result in command injection, potentially leading to arbitrary code execution on the affected system. The attack could result in total loss of confidentiality with high impact, while having lower impact on system integrity and availability (Snyk Report).

The vulnerability is remotely exploitable and requires no special privileges or user interaction. Snyk has confirmed the existence of a proof-of-concept exploit, indicating that the vulnerability is practically exploitable (Snyk Report).

The vulnerability has been fixed in total.js version 3.4.7. Users are recommended to upgrade to this version or higher to mitigate the risk. The fix includes proper validation of supported image types through a whitelist implementation (Github Commit).