This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1 Patch, Third Party Advisory
- https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1 Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.8 · ini_project, debianNVD modified 2026-10-08 22:17
Affected (CPE criteria) 2
cpe:2.3:a:ini_project:ini:*:*:*:*:*:node.js:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
References 6
- https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html Mailing List, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-INI-1048974 Exploit, Third Party Advisory
- https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html Mailing List, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-INI-1048974 Exploit, Third Party Advisory