This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-docsUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs | May 4, 2022 | Dec 11, 2020 |
| Centos_linux | — | Upgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-devel | Feb 17, 2021 | Dec 11, 2020 |
| Debian | — | Upgrade node-ini | Dec 29, 2020 | Dec 11, 2020 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejsUpgrade npm | Feb 20, 2021 | Dec 8, 2020 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-libs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-full-i18n | Feb 17, 2021 | Dec 11, 2020 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-debugsource | Mar 5, 2024 | Dec 11, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Dec 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub