CVE-2020-7788

Prototype Pollution

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Affected

ini

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 SNYK

7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

3.65% chance of exploitation in the next 30 days, 89th percentile

Published

2020-12-11

Updated

2026-10-08

Proof-of-concept exploits (2)

• https://snyk.io/vuln/SNYK-JS-INI-1048974
• advisories/GHSA-qqgx-2p2h-9c37

Security advisories

• npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1
• https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html

References

• CVE Record
• NVD entry