GitHub Advisoryadvisory · npm

GHSA-m6mg-jvjf-w44x conf-cfg-ini Prototype Pollution via malicious INI file before v1.2.2

CRITICAL Published 2022-07-26 Modified 2022-08-04 Official page ↗
Aliases
CVE-2020-28441
Ecosystem
npm
Packages
conf-cfg-ini
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321
Reviewed
2022-08-04

Affected packages

• npm conf-cfg-ini: < 1.2.2 → fixed in 1.2.2

Description

This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context.

Related

Alias · CVE (1)

  • CVE-2020-28441 This affects the package conf-cfg-ini before 1.2.2. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References