$ cve CVE-2021-23389 JSON

CVE-2021-23389

9.8

CRITICAL · CVSS 3.1 · EPSS 3.6% (pctl 89)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	3.6% — more likely to be exploited than 89% of all CVEs
Weakness	CWE-94
On CISA KEV	no
Public exploit	none known
Published	2021-07-12
Last modified	2026-06-17

Vendor	Product
totaljs	total.js