VulnerableCode Package Details - pkg:npm/total.js@2.3.0-14

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:npm/total.js@2.3.0-14

Essentials
History (5)

purl	pkg:npm/total.js@2.3.0-14

Next non-vulnerable version	3.4.8
Latest non-vulnerable version	3.4.9
Risk

Vulnerabilities affecting this package (5)

Vulnerability	Summary	Fixed by
VCID-2vcv-em7r-4baf Aliases: CVE-2019-10260 GHSA-72p5-2r6g-fm6v	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).	3.3.0-13 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-528e-s8wc-6ydu Aliases: CVE-2021-23344 GHSA-3wj8-vp9h-rm6m	Code Injection The package `total.js` is vulnerable to Remote Code Execution (RCE) via `set`.	3.4.8 Affected by 0 other vulnerabilities.
VCID-gj61-mm9w-9ufd Aliases: CVE-2019-8903 GHSA-3q32-j57w-q4w7	Path Traversal `index.js` in Total.js Platform allows path traversal.	3.2.3 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-wmct-kms3-23hk Aliases: CVE-2020-28494 GHSA-4449-hg37-77v8	Command Injection This affects the package `total.js` The issue occurs in the `image.pipe` and `image.stream` functions. The type parameter is used to build the command that is then executed using `child_process.spawn.` The issue occurs because `child_process.spawn` is called with the option shell set to true and because the type parameter is not properly sanitized.	3.4.7 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-xkck-dyh3-cfaq Aliases: CVE-2020-28495 GHSA-6cf8-qhqj-vjqm	Improperly Controlled Modification of Object Prototype Attributes The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection.	3.4.7 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-04T20:45:49.424451+00:00	GitLab Importer	Affected by	VCID-528e-s8wc-6ydu	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/total.js/CVE-2021-23344.yml	38.6.0
2026-06-04T20:44:28.338223+00:00	GitLab Importer	Affected by	VCID-wmct-kms3-23hk	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/total.js/CVE-2020-28494.yml	38.6.0
2026-06-04T20:44:24.291003+00:00	GitLab Importer	Affected by	VCID-xkck-dyh3-cfaq	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/total.js/CVE-2020-28495.yml	38.6.0
2026-06-04T20:20:19.759655+00:00	GitLab Importer	Affected by	VCID-2vcv-em7r-4baf	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/total.js/CVE-2019-10260.yml	38.6.0
2026-06-04T20:18:59.343118+00:00	GitLab Importer	Affected by	VCID-gj61-mm9w-9ufd	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/total.js/CVE-2019-8903.yml	38.6.0