Skip to main content
cve.nowby Sazabi
← npm
npmPackage

total.js

7 known vulnerabilities (2 critical, 3 high), with the versions each affects and the releases that fix them.

Latest release
3.4.13 (Nov 8, 2021): no advisory affects it
Newest unaffected release
3.4.20 (May 11, 2020)
Advisories
7 · 2 critical, 3 high
Weekly downloads
5,722
Dependents
6
Releases
500+ since 1.9.8 (Apr 3, 2016)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 7

  • Code injection in total.js

    Affected: fixed in 3.4.9.

    Fixed in 3.4.9 (released Jun 4, 2021, 87 days before disclosure).

    The latest release, 3.4.13, is not affected.

    94% of total.js downloads last week were affected versions (3K).

  • CVE-2021-23389Critical 9.8

    Arbitrary Code Execution

    Affected: fixed in 3.4.9.

    Fixed in 3.4.9 (released Jun 4, 2021, 38 days before disclosure).

    The latest release, 3.4.13, is not affected.

    94% of total.js downloads last week were affected versions (3K).

  • CVE-2021-23344Critical 9.8

    Remote Code Execution (RCE)

    Affected: fixed in 3.4.8.

    Fixed in 3.4.8 (released Feb 28, 2021, 4 days before disclosure).

    The latest release, 3.4.13, is not affected.

    93% of total.js downloads last week were affected versions (3K).

  • Command Injection

    Affected: fixed in 3.4.7.

    Fixed in 3.4.7 (released Jan 28, 2021, 5 days before disclosure).

    The latest release, 3.4.13, is not affected.

    91% of total.js downloads last week were affected versions (2.9K).

  • Prototype Pollution

    Affected: fixed in 3.4.7.

    Fixed in 3.4.7 (released Jan 28, 2021, 5 days before disclosure).

    The latest release, 3.4.13, is not affected.

    91% of total.js downloads last week were affected versions (2.9K).

  • Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).

    Affected: fixed in 3.3.0-13.

    Fixed in 3.3.0-13 (released Mar 25, 2019, 3 days before disclosure).

    The latest release, 3.4.13, is not affected.

    79% of total.js downloads last week were affected versions (2.6K).

  • index.js in Total.js Platform before 3.2.3 allows path traversal.

    Affected: fixed in 3.2.3.

    Fixed in 3.2.3 (released Feb 20, 2019, 2 days after disclosure).

    The latest release, 3.4.13, is not affected.

    77% of total.js downloads last week were affected versions (2.5K).