← All advisories

Critical severity9.8NVD Advisory· Published Jul 12, 2021· Updated Jun 17, 2026

CVE-2021-23390

CVE-2021-23390

Description

The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
total4npm	< 0.0.43	0.0.43

Affected products

3

total4/total4description
Totaljs/Total4
cpe:2.3:a:totaljs:total4:*:*:*:*:*:node.js:*:*
Range: <0.0.43
ghsa-coords
pkg:npm/total4
Range: < 0.0.43

Patches

Vulnerability mechanics

References

5

github.com/totaljs/framework4/commit/8a72d8c20f38bbcac031a76a51238aa528f68821nvdPatchThird Party AdvisoryWEB
snyk.io/vuln/SNYK-JS-TOTAL4-1130527nvdExploitPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-g7mq-rfj2-25wqghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2021-23390ghsaADVISORY
github.com/totaljs/framework4/blob/master/utils.js%23L5430-L5455nvdBroken LinkWEB

News mentions

0

No linked articles in our index yet.