VulnerableCode Package Details - pkg:npm/total.js@3.3.2

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:npm/total.js@3.3.2

Essentials
History (3)

purl	pkg:npm/total.js@3.3.2

Next non-vulnerable version	3.4.8
Latest non-vulnerable version	3.4.9
Risk

Vulnerabilities affecting this package (3)

Vulnerability	Summary	Fixed by
VCID-528e-s8wc-6ydu Aliases: CVE-2021-23344 GHSA-3wj8-vp9h-rm6m	Code Injection The package `total.js` is vulnerable to Remote Code Execution (RCE) via `set`.	3.4.8 Affected by 0 other vulnerabilities.
VCID-wmct-kms3-23hk Aliases: CVE-2020-28494 GHSA-4449-hg37-77v8	Command Injection This affects the package `total.js` The issue occurs in the `image.pipe` and `image.stream` functions. The type parameter is used to build the command that is then executed using `child_process.spawn.` The issue occurs because `child_process.spawn` is called with the option shell set to true and because the type parameter is not properly sanitized.	3.4.7 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-xkck-dyh3-cfaq Aliases: CVE-2020-28495 GHSA-6cf8-qhqj-vjqm	Improperly Controlled Modification of Object Prototype Attributes The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection.	3.4.7 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-04T20:45:50.967971+00:00	GitLab Importer	Affected by	VCID-528e-s8wc-6ydu	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/total.js/CVE-2021-23344.yml	38.6.0
2026-06-04T20:44:29.766277+00:00	GitLab Importer	Affected by	VCID-wmct-kms3-23hk	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/total.js/CVE-2020-28494.yml	38.6.0
2026-06-04T20:44:25.682653+00:00	GitLab Importer	Affected by	VCID-xkck-dyh3-cfaq	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/total.js/CVE-2020-28495.yml	38.6.0