CVE-2021-23389

The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.

• CWE-94

• https://github.com/totaljs/framework/blob/master/utils.js%23L6606-L6631Broken Link
• https://github.com/totaljs/framework/commit/887b0fa9e162ef7a2dd9cec20a5ca122726373b3Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-TOTALJS-1088607Exploit, Patch, Third Party Advisory
• https://github.com/totaljs/framework/blob/master/utils.js%23L6606-L6631Broken Link
• https://github.com/totaljs/framework/commit/887b0fa9e162ef7a2dd9cec20a5ca122726373b3Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-TOTALJS-1088607Exploit, Patch, Third Party Advisory

Published

Jul 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23383The package handlebars before 4.7.7 are vulnerable to Protot…9.8
• CVE-2021-23384The package koa-remove-trailing-slashes before 2.0.2 are vul…5.4
• CVE-2021-23385This affects all versions of package Flask-Security. When us…6.1
• CVE-2021-23386This affects the package dns-packet before 5.2.2. It creates…6.5
• CVE-2021-23387The package trailing-slash before 2.0.1 are vulnerable to Op…6.1
• CVE-2021-23388The package forms before 1.2.1, from 1.3.0 and before 1.3.2 …5.3
• CVE-2021-2339Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-23390The package total4 before 0.0.43 are vulnerable to Arbitrary…9.8
• CVE-2021-23391This affects all versions of package calipso. It is possible…7.1
• CVE-2021-23392The package locutus before 2.0.15 are vulnerable to Regular …7.5
• CVE-2021-23393This affects the package Flask-Unchained before 0.9.0. When …5.4
• CVE-2021-23394The package studio-42/elfinder before 2.1.58 are vulnerable …9.8