CVE-2020-28448: Prototype Pollution in multi-ini
Summary
CVE-2020-28448: Prototype Pollution in multi-ini. Affects multi-ini versions < 2.1.1. Fixed in 2.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The multi-ini package is an npm package used for parsing and manipulating INI files. It provides functionality to read, write, and modify INI files in JavaScript applications. The package is widely used in various projects and allows developers to work with INI configuration files in a convenient manner. However, a vulnerability has been discovered in versions before 2.1.1 that allows for prototype pollution.
Vulnerability Detail
The vulnerability, identified as CVE-2020-28448, is a prototype pollution vulnerability in the multi-ini package. By specifying the proto object as part of an array, it is possible to pollute an object's prototype. This can lead to various security issues, including remote code execution, data tampering, and privilege escalation. The impact of this vulnerability is critical, with a CVSS score of 9.8.
How To Fix
Minimum fixed version
2.1.1
This is the first release that contains the fix.
npm install multi-ini@2.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the multi-ini package to the fixed version to mitigate the risk of exploitation.
Conclusion
The multi-ini package before version 2.1.1 is vulnerable to prototype pollution, which can have severe security implications. It is crucial to update the package to the fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for multi-ini →
FAQ
multi-ini is an npm package used for parsing and manipulating INI files in JavaScript applications.
Prototype pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to potential security issues.
The vulnerability can result in remote code execution, data tampering, and privilege escalation.
To fix this vulnerability, update the multi-ini package to version 2.1.1 or later.
No, there is no known workaround for this vulnerability. Updating the package is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for multi-ini.
