GHSA-7vrv-5m2h-rjw9
ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse`
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | ion-parser | <= 0.5.2 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with `parse` , they will pollute the prototype on the application. This can be exploited further depending on the context.
References
External links from the advisory. They lead to third-party sites.