CVE-2021-32831

Katalog CVE

CVSS 7.2 · High EPSS 1,5%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada totaljs total.js. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. In total.js framework before version 3.4.9, calling the utils.set function with user-controlled values leads to code-injection. This can cause a variety of impacts that include arbitrary code execution. This is fixed in version 3.4.9.

Rincian

Terbit di NVD

30 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/totaljs/framework/commit/887b0fa9e162ef7a2dd9cec20a5ca122726373b3 patch · advisory pihak ketiga
• https://securitylab.github.com/advisories/GHSL-2021-066-totaljs-totaljs/ exploit · patch · advisory pihak ketiga
• https://github.com/totaljs/framework/blob/e644167d5378afdc45cb0156190349b2c07ef235/changes.txt#L11 advisory pihak ketiga
• https://www.npmjs.com/package/total.js product · advisory pihak ketiga