CVE-2020-28472: Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader
Summary
CVE-2020-28472: Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader. Affects aws-sdk versions < 2.814.0. Fixed in 2.814.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aws-sdk package is a popular npm package that provides a JavaScript interface for interacting with Amazon Web Services (AWS) APIs. It allows developers to easily integrate AWS services into their applications. The @aws-sdk/shared-ini-file-loader package is a dependency of aws-sdk and is responsible for loading shared configuration files in INI format. These files contain AWS credentials and other configuration settings. The vulnerability in these packages allows an attacker to pollute the prototype of an application by submitting a malicious INI file. This can lead to further exploitation depending on the context.
Vulnerability Detail
The vulnerability, identified as CVE-2020-28472, occurs when an application parses an INI file using the loadSharedConfigFiles function provided by the @aws-sdk/shared-ini-file-loader package. By submitting a specially crafted INI file, an attacker can manipulate the prototype of the application, potentially leading to code execution or other malicious activities. The impact of this vulnerability depends on the context in which the polluted prototype is used.
How To Fix
Latest published version: 2.1693.0 as of 22 Oct 2026
npm install aws-sdk@2.1693.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.814.0
This is the first release that contains the fix.
npm install aws-sdk@2.814.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the affected packages to their fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, the aws-sdk and @aws-sdk/shared-ini-file-loader packages are vulnerable to prototype pollution via file load. This vulnerability allows an attacker to pollute the prototype of an application by submitting a malicious INI file. To mitigate this risk, it is crucial to update the affected packages to their fixed versions and implement proper input validation and sanitization when parsing INI files. For further support, you can contact DevNack.com.
See every vulnerability recorded for aws-sdk →
FAQ
Prototype pollution is a vulnerability that occurs when an attacker is able to modify the prototype of an object, allowing them to control or manipulate its behavior. In the context of this vulnerability, an attacker can pollute the prototype of an application by submitting a malicious INI file.
The consequences of this vulnerability depend on the context in which the polluted prototype is used. It could potentially lead to code execution, privilege escalation, or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for any open-source vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to update the affected packages to their fixed versions to mitigate the risk.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide guidance and assistance in fixing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for aws-sdk.
