GitHub Advisoryadvisory · npm

GHSA-2f6g-w5gj-c93h Prototype Pollution in iniparserjs

MEDIUM Published 2021-04-13 Modified 2021-03-22 Official page ↗
Aliases
CVE-2021-23328
Ecosystem
npm
Packages
iniparserjs
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-1321
Reviewed
2021-03-22

Affected packages

• npm iniparserjs: <= 1.0.4 (no fix yet)

Description

This affects all versions of package iniparserjs. This vulnerability relates when ini_parser.js is concentrating arrays. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.

Related

Alias · CVE (1)

  • CVE-2021-23328 This affects all versions of package iniparserjs. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References