GHSA-96r7-mrqf-jhcc

Suggest an improvement
Source
https://github.com/advisories/GHSA-96r7-mrqf-jhcc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/06/GHSA-96r7-mrqf-jhcc/GHSA-96r7-mrqf-jhcc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-96r7-mrqf-jhcc
Aliases
Published
2020-06-10T20:27:53Z
Modified
2026-03-13T21:56:37.625571Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Prototype Pollution in ini-parser
Details

All versions of ini-parser are vulnerable to prototype pollution. The parse function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-10T20:13:15Z",
    "cwe_ids": [
        "CWE-915"
    ],
    "severity": "CRITICAL",
    "nvd_published_at": "2020-04-02T18:15:00Z"
}
References

Affected packages

npm / ini-parser

Package

Name
ini-parser
View open source insights on deps.dev
Purl
pkg:npm/ini-parser

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
0.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/06/GHSA-96r7-mrqf-jhcc/GHSA-96r7-mrqf-jhcc.json"