CVE-2021-23389: Code Injection in total.js
Summary
CVE-2021-23389: Code Injection in total.js. Affects total.js versions < 3.4.9. Fixed in 3.4.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
total.js is an open-source web application framework for Node.js. It provides a modular structure and various features for building web applications. The U.set() and U.get() functions in total.js versions before 3.4.9 are vulnerable to code injection, allowing an attacker to execute arbitrary code. This vulnerability can be exploited to gain unauthorized access, manipulate data, or perform other malicious activities.
Vulnerability Detail
The vulnerability in total.js arises from improper input validation and sanitization in the U.set() and U.get() functions. Attackers can craft malicious input that is not properly handled by these functions, leading to code injection. This can result in arbitrary code execution with the privileges of the application, potentially compromising the entire system. The vulnerability has a CVSS score of 9.8 (Critical severity).
How To Fix
Latest published version: 3.4.13 as of 23 Oct 2026
npm install total.js@3.4.13Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.9
This is the first release that contains the fix.
npm install total.js@3.4.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of total.js to mitigate the risk of code injection.
Conclusion
The code injection vulnerability in total.js versions before 3.4.9 can lead to arbitrary code execution and potential system compromise. It is recommended to update to the latest version of total.js to ensure the security of your application. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for total.js →
FAQ
total.js is an open-source web application framework for Node.js. It provides a modular structure and various features for building web applications.
Code injection is a vulnerability that allows an attacker to insert and execute arbitrary code in an application. In the case of total.js, the U.set() and U.get() functions are vulnerable to code injection, enabling an attacker to execute malicious code.
This vulnerability can lead to unauthorized access, data manipulation, and other malicious activities. An attacker could exploit this vulnerability to take control of the affected system and perform actions with the privileges of the application.
To fix this vulnerability, update your total.js installation to version 3.4.9 or later. This version includes a fix for the code injection vulnerability in the U.set() and U.get() functions.
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of total.js to mitigate the risk of code injection.
References
Related vulnerabilities
Recent vulnerabilities recorded for total.js.
