This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs | May 4, 2022 | Dec 11, 2020 |
| Centos_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-full-i18n | Feb 17, 2021 | Dec 11, 2020 |
| Debian | — | Upgrade node-ini | Dec 29, 2020 | Dec 11, 2020 |
| Oracle_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade npmUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs | Feb 20, 2021 | Dec 8, 2020 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-devel | Feb 17, 2021 | Dec 11, 2020 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-devel | Mar 5, 2024 | Dec 11, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Dec 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub