CVE-2020-28495: Prototype pollution in total.js
Summary
CVE-2020-28495: Prototype pollution in total.js. Affects total.js versions < 3.4.7. Fixed in 3.4.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Total.js is an open-source web application framework written in JavaScript. It provides a modular structure for building web applications and APIs. The package total.js is vulnerable to prototype pollution, a type of vulnerability that allows an attacker to modify the prototype of an object and potentially manipulate its behavior. This vulnerability exists in versions prior to 3.4.7 of total.js.
Vulnerability Detail
The vulnerability in total.js arises from the set function, which is used to set a value into an object based on a given path. However, the keys of the path are not properly sanitized, leading to a prototype pollution vulnerability. An attacker can exploit this vulnerability to achieve various malicious outcomes, including Denial of Service (DoS), Remote Code Execution, or Property Injection. The severity of the impact depends on the specific application using total.js.
How To Fix
Latest published version: 3.4.13 as of 23 Oct 2026
npm install total.js@3.4.13Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.7
This is the first release that contains the fix.
npm install total.js@3.4.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of total.js to mitigate the risk of exploitation.
Conclusion
The total.js package prior to version 3.4.7 is vulnerable to prototype pollution. This vulnerability can have serious consequences, including DoS, Remote Code Execution, or Property Injection. It is crucial to update to version 3.4.7 or later to mitigate the risk. For further assistance, contact DevNack.com.
See every vulnerability recorded for total.js →
FAQ
Prototype pollution is a vulnerability that allows an attacker to modify the prototype of an object, potentially leading to unexpected behavior or security issues.
The impact of this vulnerability depends on the application using total.js. It can range from Denial of Service (DoS) to Remote Code Execution or Property Injection.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json.
No, there are no known workarounds for this vulnerability. It is crucial to update to the fixed version of total.js.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for total.js.
