CVE-2020-28461

critical

Description

This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.

References

https://security.snyk.io/vuln/SNYK-JS-JSINI-1048970

https://github.com/Sdju/js-ini/commit/fa17efb7e3a7c9464508a254838d4c231784931e

Details

Source: Mitre, NVD

Published: 2022-07-25

Updated: 2022-08-01

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H