{"id":"CVE-2020-28495","aliases":["GHSA-6cf8-qhqj-vjqm","SNYK-JS-TOTALJS-1046671"],"url":"https://o3.security/vulnerability/CVE-2020-28495","summary":"Prototype pollution in total.js","details":"This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection.","published":"2021-02-02T11:15:13.257Z","modified":"2026-07-08T06:49:59.940708125Z","cvss":{"score":7.3,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"total.js","fixedVersion":"3.4.7"}],"fix":{"url":"https://github.com/totaljs/framework/commit/b3f901561d66ab799a4a99279893b94cad7ae4ff","label":"totaljs/framework@b3f9015"},"references":[{"type":"WEB","url":"https://docs.totaljs.com/latest/en.html%23api~FrameworkUtils~U.set"},{"type":"WEB","url":"https://github.com/totaljs/framework/blob/master/utils.js%23L6606"},{"type":"WEB","url":"https://github.com/totaljs/framework/blob/master/utils.js%23L6617"},{"type":"FIX","url":"https://github.com/totaljs/framework/commit/b3f901561d66ab799a4a99279893b94cad7ae4ff"},{"type":"FIX","url":"https://snyk.io/vuln/SNYK-JS-TOTALJS-1046671"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T06:49:59.940708125Z"}}