This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
CVSS Details
- CVSS 3.1 Base Score: 7.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-devel | May 4, 2022 | Dec 11, 2020 |
| Centos_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-develUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-packaging | Feb 17, 2021 | Dec 11, 2020 |
| Debian | — | Upgrade node-ini | Dec 29, 2020 | Dec 11, 2020 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-libs | Feb 20, 2021 | Dec 8, 2020 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docs | Feb 17, 2021 | Dec 11, 2020 |
| Rocky_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-full-i18n | Mar 5, 2024 | Dec 11, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Dec 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub