GitHub Advisoryadvisory · npm

GHSA-m939-vrfp-9v8p js-ini Prorotype Pollution when malicious INI files submitted to an application that parses it with `parse`

CRITICAL Published 2022-07-26 Modified 2022-08-06 Official page ↗
Aliases
CVE-2020-28461
Ecosystem
npm
Packages
js-ini
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321
Reviewed
2022-08-06

Affected packages

• npm js-ini: < 1.3.0 → fixed in 1.3.0

Description

This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with `parse` , they will pollute the prototype on the application. This can be exploited further depending on the context.

Related

Alias · CVE (1)

  • CVE-2020-28461 This affects the package js-ini before 1.3.0. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References