js-ini Prorotype Pollution when malicious INI files submitted to an application that parses it with `parse`
Critical severity
GitHub Reviewed
Published
Jul 26, 2022
to the GitHub Advisory Database
•
Updated Jan 27, 2023
Description
Published by the National Vulnerability Database
Jul 25, 2022
Published to the GitHub Advisory Database
Jul 26, 2022
Reviewed
Aug 6, 2022
Last updated
Jan 27, 2023
This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with
parse, they will pollute the prototype on the application. This can be exploited further depending on the context.References