CVE-2019-15954: Total.js CMS widget tag sandbox escape leads to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.9 with network reachability, low privileges required, scope change, and public exploit code plus very high EPSS make this a top remediation priority.

What it is

Total.js CMS 12.0.0 evaluates widget tag content server side, and an authenticated user holding the widgets privilege can escape the sandbox object with a crafted <script total> tag. The flaw is classified as missing authorization (CWE-862) and carries a CVSS 3.1 base score of 9.9, so it matters because a low-privileged account can reach full server compromise.

Impact

The attacker executes arbitrary operating system commands on the remote server with the privileges of the CMS process, giving full control of the host and any data or credentials it can reach.

Attack surface

Reached over the network through the widget creation functionality of the CMS; the attacker must be authenticated and hold the widgets privilege, and no user interaction is required.

Exploitation

Public exploit write-ups exist (Packet Storm, Full Disclosure, and a GitHub disclosure report), and EPSS is 0.78691 (99.568th percentile), indicating high predicted exploitation activity; the CVE is not listed in CISA KEV.

What to do

• Upgrade Total.js CMS past 12.0.0 to a release that fixes the widget tag sandbox escape; no fixed version is stated in this record, so confirm with the vendor.
• Restrict the widgets privilege to trusted administrators and review all accounts currently holding it.
• Run the CMS under a low-privileged service account with no access to sensitive files or the host shell.
• Block or filter widget content containing <script total> tags and server-side JavaScript evaluation until patched.
• Place the CMS behind network controls so it is not directly reachable from untrusted networks.

Detection

• Search CMS widget content and logs for <script total> tags or references to global.process.mainModule.require and child_process.
• Alert on unexpected child processes spawned by the CMS server process (for example shell or command interpreters).
• Monitor for outbound connections or file writes originating from the CMS process that are inconsistent with normal operation.
• Audit creation and modification of widgets, especially by accounts that do not normally use the widgets privilege.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.