CVE-2021-32831: Code Injection in total.js
Summary
CVE-2021-32831: Code Injection in total.js. Affects total.js versions < 3.4.9. Fixed in 3.4.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Total.js is a framework for Node.js platform written in pure JavaScript, similar to PHP's Laravel or Python's Django or ASP.NET MVC. It provides a range of features and functionalities for building web applications. However, in versions prior to 3.4.9, a vulnerability exists that allows for code injection when the utils.set function is called with user-controlled values. This can lead to arbitrary code execution and potential security breaches.
Vulnerability Detail
The vulnerability in total.js arises from the improper handling of user-controlled values in the utils.set function. Attackers can exploit this by injecting malicious code, which can have severe consequences such as unauthorized access, data manipulation, or even complete system compromise. The impact of this vulnerability is high, as it allows for arbitrary code execution, enabling attackers to execute commands on the affected system.
How To Fix
Latest published version: 3.4.13 as of 23 Oct 2026
npm install total.js@3.4.13Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.9
This is the first release that contains the fix.
npm install total.js@3.4.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if updating to the latest version is not immediately feasible, it is recommended to sanitize and validate user-controlled values before passing them to the utils.set function. This can help mitigate the risk of code injection by ensuring that only safe and expected values are processed.
Conclusion
In conclusion, the code injection vulnerability in total.js can lead to arbitrary code execution and potential security breaches. It is crucial to update to version 3.4.9 or later to fix this vulnerability. Sanitizing and validating user-controlled values can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for total.js →
FAQ
Total.js is a framework for Node.js platform that provides a range of features and functionalities for building web applications.
Code injection is a vulnerability that allows an attacker to insert and execute malicious code within an application or system.
The potential impacts of this vulnerability include arbitrary code execution, unauthorized access, data manipulation, and system compromise.
To fix this vulnerability, update total.js to version 3.4.9 or later, which includes a fix for the code injection vulnerability.
As a workaround, sanitize and validate user-controlled values before passing them to the utils.set function.
Related vulnerabilities
Recent vulnerabilities recorded for total.js.
