Prototype pollution in multi-ini

HOCH 8.1CVE-2020-28460 · GHSA-67mq-h2r9-rh2m · SNYK-JS-MULTIINI-1053229 · Published 22/12/2020 · updated 17/06/2026

Kurz gesagt

CVE-2020-28460 ist eine Schwachstelle (HOCH (CVSS 8.1)) in multi-ini (multi-ini project), multi-ini.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.5%, höher als bei 75.0% aller Schwachstellen.
Abhilfe: auf 2.1.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
multi-ini multi-ini_project	`< 2.1.2`	`2.1.2`
multi-ini npm	`< 2.1.2`	`2.1.2`

Description

This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448.

NVD description

This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448.

References

nvd.nist.gov/vuln/detail/CVE-2020-28460 · ADVISORY
evangelion1204/multi-ini commit 6b2212b · WEB
snyk.io/vuln/SNYK-JS-MULTIINI-1053229 · WEB

Weitere Schwachstellen in multi-ini

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free