GitHub Advisoryadvisory · npm

GHSA-7vrv-5m2h-rjw9 ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse`

CRITICAL Published 2022-07-26 Modified 2022-08-06 Official page ↗
Aliases
CVE-2020-28462
Ecosystem
npm
Packages
ion-parser
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321
Reviewed
2022-08-06

Affected packages

• npm ion-parser: <= 0.5.2 (no fix yet)

Description

This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with `parse` , they will pollute the prototype on the application. This can be exploited further depending on the context.

Related

Alias · CVE (1)

  • CVE-2020-28462 This affects all versions of package ion-parser. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References