CVE-2021-23344 The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set

Description

The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.

Affected products and versions

Product	Affected versions	Fixed in
total.js 3.4	earliest → < 3.4.8	3.4.8

Other CVEs of total.js

The 4 CVEs of total.js →

CVE-2021-23389 The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions 9.8 Critical CVE-2020-28494 This affects the package total.js before 3.4.7 8.6 High CVE-2020-28495 This affects the package total.js before 3.4.7 7.3 High