~ / search / GHSA-m6mg-jvjf-w44x

GHSA-m6mg-jvjf-w44x

conf-cfg-ini Prototype Pollution via malicious INI file before v1.2.2

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-28441

Packages

EcosystemPackageAffectedFixed in
npm conf-cfg-ini < 1.2.2 1.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context.

References

External links from the advisory. They lead to third-party sites.