This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-docs | May 4, 2022 | Dec 11, 2020 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-debugsource | Feb 17, 2021 | Dec 11, 2020 |
| Debian | — | Upgrade node-ini | Dec 29, 2020 | Dec 11, 2020 |
| Oracle_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-develUpgrade npm | Feb 20, 2021 | Dec 8, 2020 |
| Redhat_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-debugsource | Feb 17, 2021 | Dec 11, 2020 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade npm | Mar 5, 2024 | Dec 11, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Dec 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub