CVE-2020-28460: Prototype Pollution in multi-ini
Summary
CVE-2020-28460: Prototype pollution in multi-ini. Affects multi-ini versions < 2.1.2. Fixed in 2.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
multi-ini is an npm package that provides functionality for parsing and manipulating INI files. It allows users to read, write, and modify INI configurations in JavaScript applications. The package is widely used in various projects that require INI file handling. However, versions before 2.1.2 are vulnerable to prototype pollution.
Vulnerability Detail
The vulnerability in multi-ini (CVE-2020-28460) allows an attacker to pollute an object's prototype by manipulating the constructor.proto object within an array. This bypasses the fix for CVE-2020-28448. Prototype pollution can lead to various security issues, including remote code execution, denial of service, and data tampering. The impact of this vulnerability depends on how the affected package is used within an application.
How To Fix
Latest published version: 2.3.2 as of 23 Oct 2026
npm install multi-ini@2.3.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.2
This is the first release that contains the fix.
npm install multi-ini@2.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of multi-ini as soon as possible.
Conclusion
The multi-ini package before version 2.1.2 is vulnerable to prototype pollution, which can have various security implications. It is crucial for developers to update to the latest version of multi-ini (2.1.2 or later) to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for multi-ini →
FAQ
multi-ini is an npm package used for parsing and manipulating INI files in JavaScript applications.
Prototype pollution is a vulnerability that allows an attacker to modify an object's prototype, leading to potential security issues.
The impact of this vulnerability depends on how the affected package is used within an application. It can lead to remote code execution, denial of service, and data tampering.
To fix this vulnerability, update the multi-ini package to version 2.1.2 or later.
There is no known workaround for this vulnerability. It is recommended to update to the latest version of multi-ini.
References
Related vulnerabilities
Recent vulnerabilities recorded for multi-ini.
