This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-develUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs | May 4, 2022 | Dec 11, 2020 |
| Centos_linux | — | Upgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-devel | Feb 17, 2021 | Dec 11, 2020 |
| Debian | — | Upgrade node-ini | Dec 29, 2020 | Dec 11, 2020 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade npmUpgrade nodejsUpgrade nodejs-libs | Feb 20, 2021 | Dec 8, 2020 |
| Redhat_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-libsUpgrade nodejs-docs | Feb 17, 2021 | Dec 11, 2020 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-devel | Mar 5, 2024 | Dec 11, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Dec 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub