critical9.8
CVE-2020-28461
js-ini Prorotype Pollution when malicious INI files submitted to an application that parses it with `parse`
Impact
This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with `parse` , they will pollute the prototype on the application. This can be exploited further depending on the context.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | js-ini | < 1.3.0 | 1.3.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Js-Ini Project | Js-Ini | before 1.3.0 |