CVE-2021-23389

Total.js prior to 3.4.9 is vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions. The issue, documented across multiple feeds (CVE-2021-23389, GHSA-7FM6-GXQG-2PWR, OSV, SNYK), stems from code in total.js (notably in utilities) that allows execution of arbitrary code. Impact...

CVE-2021-23389

The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set and U.get functions...

@pl-test/c (>=1.1.0, <=1.1.1), @pl-test/e (1.1.0) potentially affected by CVE-2021-23389 +1 more via total.js (3.2.4)

total.js NPM version 3.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on total.js and may be impacted: - @pl-test/c =1.1.0, =1.1.1 - @pl-test/e 1.1.0 Source cves: CVE-2021-23389, CVE-2021-32831 Source advisory: SNYK:JS-TOTALJS-6056532...