VYPR
← All advisories
Critical severityNVD Advisory· Published Jul 12, 2021· Updated Sep 16, 2024

Arbitrary Code Execution

CVE-2021-23389

Description

The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

total.js before 3.4.9 allows arbitrary code execution via U.set() and U.get() due to insufficient input sanitization.

Vulnerability

The U.set() and U.get() functions in total.js before version 3.4.9 are vulnerable to arbitrary code execution. The functions dynamically construct and execute code using new Function() without sanitizing user-supplied path arguments, allowing injection of malicious JavaScript. Affected versions: all prior to 3.4.9.

Exploitation

An attacker can pass a crafted path string containing arbitrary JavaScript (e.g., using semicolons and function calls) to U.set() or U.get(). If the application passes user input to these functions, no authentication or special privileges are needed. The PoC from Snyk [3] demonstrates executing exec("touch HACKED") via the path argument.

Impact

Successful exploitation results in arbitrary code execution in the Node.js process context, potentially leading to full system compromise, data exfiltration, or denial of service.

Mitigation

Upgrade to total.js version 3.4.9 or higher, which adds a regex check to block dangerous patterns (__proto__, constructor, prototype, eval, function, etc.) in path arguments [2]. No workaround is available; immediate upgrade is recommended.

References
  1. Fixed security issue in `U.set()` and `U.get()`. · totaljs/framework@887b0fa
  2. Snyk Vulnerability Database | Snyk

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
total.jsnpm
< 3.4.93.4.9

Affected products

2

Patches

1
887b0fa9e162

Fixed security issue in `U.set()` and `U.get()`.

https://github.com/totaljs/frameworkPeter ŠirkaJun 4, 2021via ghsa
commit
2 files changed · +9 −4
  • changes.txt+1 −0 modified
    @@ -4,6 +4,7 @@
 - added `insecure` flag into the `U.request()` method
 - added `RESTBuilder.insecure()` method
 - fixed security issue when parsing query arguments (reported by <https://github.com/fl4x>)
+- fixed security in `U.get()` and `U.set()` (reported by Agustin Gianni)
 
 ======= 3.4.8
  • utils.js+8 −4 modified
    @@ -6617,12 +6617,16 @@ exports.parseTheme = function(value) {
 	return value === '?' ? CONF.default_theme : value;
 };
 
+
 exports.set = function(obj, path, value) {
 	var cachekey = 'S+' + path;
 
 	if (F.temporary.other[cachekey])
 		return F.temporary.other[cachekey](obj, value);
 
+	if ((/__proto__|constructor|prototype|eval|function|\*|\+|;|\s|\(|\)|!/).test(path))
+		return value;
+
 	var arr = parsepath(path);
 	var builder = [];
 
@@ -6636,12 +6640,9 @@ exports.set = function(obj, path, value) {
 	var ispush = v.lastIndexOf('[]') !== -1;
 	var a = builder.join(';') + ';var v=typeof(a)===\'function\'?a(U.get(b)):a;w' + (v[0] === '[' ? '' : '.') + (ispush ? v.replace(REGREPLACEARR, '.push(v)') : (v + '=v')) + ';return v';
 
-	if ((/__proto__|constructor|prototype|eval/).test(a))
-		throw new Error('Potential vulnerability');
-
 	var fn = new Function('w', 'a', 'b', a);
 	F.temporary.other[cachekey] = fn;
-	fn(obj, value, path);
+	return fn(obj, value, path);
 };
 
 exports.get = function(obj, path) {
@@ -6651,6 +6652,9 @@ exports.get = function(obj, path) {
 	if (F.temporary.other[cachekey])
 		return F.temporary.other[cachekey](obj);
 
+	if ((/__proto__|constructor|prototype|eval|function|\*|\+|;|\s|\(|\)|!/).test(path))
+		return;
+
 	var arr = parsepath(path);
 	var builder = [];

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.