# CVE-2020-28495: total.js prototype pollution in set function

Source: https://junglewise.ai/threats/cve-2020-28495-total-js-prototype-pollution-in-set-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-02-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-28495 · Severity: low · CVSS 3.1 · Published 2021-02-05

total.js is a Node.js web framework library that provides utility functions for manipulating objects. A prototype pollution vulnerability in the set() function allows attackers to inject properties into object prototypes, potentially causing denial of service, property injection, or in some contexts remote code execution depending on how the application uses the affected function.

Technologies: [total.js (npm)](https://junglewise.ai/threats/technologies/total-js). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-28495 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-28495 being exploited in the wild.

**How severe is CVE-2020-28495?** Low severity, with a CVSS score of 3.1, published 5 February 2021.

**Which products and versions are affected?** total.js (npm) SEMVER:introduced=0,fixed=3.4.7.

**Is there a fix for CVE-2020-28495?** Yes. total.js (npm): upgrade to 3.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-28495 attacked?** It is attacked over the network.

**Am I affected by CVE-2020-28495?** Check whether you run total.js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- total.js (npm): upgrade to 3.4.7 or later

  ```sh
  npm install total.js@3.4.7
  ```


## Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in the total.js set() utility function that fails to properly sanitize path keys when setting values into objects. An attacker can craft a malicious path string containing prototype pollution sequences (such as "__proto__" or "constructor.prototype") to pollute the Object prototype. The attack requires network access and no authentication, but impact depends on the application's usage patterns. Versions before 3.4.7 are affected; the fix adds validation to reject paths that target prototype properties.

## Affected products

- total.js total.js before 3.4.7

## Identifiers

- CVE-2020-28495
- GHSA-6cf8-qhqj-vjqm

## Timeline

- 2021-02-05: disclosed
- 2021-02-03: patched: Fixed in version 3.4.7

## References

- [https://github.com/totaljs/framework/commit/b3f901561d66ab799a4a99279893b94cad7ae4ff](https://github.com/totaljs/framework/commit/b3f901561d66ab799a4a99279893b94cad7ae4ff)

## Related threats

- [total.js code injection in U.set() and U.get()](https://junglewise.ai/threats/cve-2021-23389-total-js-code-injection-in-u-set-and-u-get)
- [total.js code injection in utils.set](https://junglewise.ai/threats/cve-2021-32831-total-js-code-injection-in-utils-set)
- [Total.js Remote Code Execution in U.set method](https://junglewise.ai/threats/cve-2021-23344-total-js-remote-code-execution-in-u-set-method)
- [total.js command injection in image processing](https://junglewise.ai/threats/cve-2020-28494-total-js-command-injection-in-image-processing)
- [Total.js CMS cross-site scripting in admin interface](https://junglewise.ai/threats/cve-2019-10260-total-js-cms-cross-site-scripting-in-admin-interface)