CVE-2021-32831 Code injection in total.js

What is CVE-2021-32831?

CVE-2021-32831 is a high-severity vulnerability in totaljs framework, published on 30 Aug 2021.

Official description

Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. In total.js framework before version 3.4.9, calling the utils.set function with user-controlled values leads to code-injection. This can cause a variety of impacts that include arbitrary code execution. This is fixed in version 3.4.9.

Weakness: CWE-94

Which versions are affected by CVE-2021-32831?

2 open source packages ship an affected version, including total.js. It affects 1 product.

Products include Totaljs Total.js.

How do I fix CVE-2021-32831?

Upgrade total.js to 3.4.9 or later.

Is CVE-2021-32831 being exploited?

There is no known exploitation of CVE-2021-32831 in the wild and no public exploit code.

Other vulnerabilities in totaljs framework

• CVE-2021-23389 Arbitrary Code Execution Critical 9.8
• CVE-2021-23344 Remote Code Execution (RCE) Critical 9.8
• CVE-2024-48655 Code injection in n/a High 8.8
• CVE-2022-44019 Command injection in n/a High 8.8
• CVE-2020-28494 Command Injection High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vwhc-pww7-72x6.