CVE-2020-28495

This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection.

• https://docs.totaljs.com/latest/en.html%23api~FrameworkUtils~U.setBroken Link
• https://github.com/totaljs/framework/blob/master/utils.js%23L6606Broken Link
• https://github.com/totaljs/framework/blob/master/utils.js%23L6617Broken Link
• https://github.com/totaljs/framework/commit/b3f901561d66ab799a4a99279893b94cad7ae4ffPatch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-TOTALJS-1046671Exploit, Patch, Third Party Advisory
• https://docs.totaljs.com/latest/en.html%23api~FrameworkUtils~U.setBroken Link
• https://github.com/totaljs/framework/blob/master/utils.js%23L6606Broken Link
• https://github.com/totaljs/framework/blob/master/utils.js%23L6617Broken Link
• https://github.com/totaljs/framework/commit/b3f901561d66ab799a4a99279893b94cad7ae4ffPatch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-TOTALJS-1046671Exploit, Patch, Third Party Advisory

Published

Feb 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-2849Vulnerability in the Oracle Depot Repair product of Oracle E…8.2
• CVE-2020-28490The package async-git before 1.13.2 are vulnerable to Comman…9.8
• CVE-2020-28491This affects the package com.fasterxml.jackson.dataformat:ja…7.5
• CVE-2020-28492Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-28493This affects the package jinja2 from 0.0.0 and before 2.11.3…5.3
• CVE-2020-28494This affects the package total.js before 3.4.7. The issue oc…8.6
• CVE-2020-28496This affects the package three before 0.125.0. This can happ…7.5
• CVE-2020-28498The package elliptic before 6.5.4 are vulnerable to Cryptogr…6.8
• CVE-2020-28499All versions of package merge are vulnerable to Prototype Po…9.8
• CVE-2020-2850Vulnerability in the Oracle Depot Repair product of Oracle E…8.2
• CVE-2020-28500Lodash versions prior to 4.17.21 are vulnerable to Regular E…5.3
• CVE-2020-28501This affects the package es6-crawler-detect before 3.1.3. No…7.5