CVE-2021-23389 The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions

Description

The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.

Affected products and versions

Product	Affected versions	Fixed in
total.js 3.4	earliest → < 3.4.9	3.4.9

Other CVEs of total.js

The 4 CVEs of total.js →

CVE-2021-23344 The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set 9.8 Critical CVE-2020-28494 This affects the package total.js before 3.4.7 8.6 High CVE-2020-28495 This affects the package total.js before 3.4.7 7.3 High