~ / search / GHSA-m939-vrfp-9v8p

GHSA-m939-vrfp-9v8p

js-ini Prorotype Pollution when malicious INI files submitted to an application that parses it with `parse`

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-28461

Packages

EcosystemPackageAffectedFixed in
npm js-ini < 1.3.0 1.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with `parse` , they will pollute the prototype on the application. This can be exploited further depending on the context.

References

External links from the advisory. They lead to third-party sites.