Prototype pollution in multi-ini

高危 8.1CVE-2020-28460 · GHSA-67mq-h2r9-rh2m · SNYK-JS-MULTIINI-1053229 · Published 22/12/2020 · updated 17/06/2026

要点

CVE-2020-28460 是影响 multi-ini (multi-ini project), multi-ini 的高危 (CVSS 8.1)漏洞。
未来 30 天内被利用的概率（EPSS）：1.5%，高于 75.0% 的漏洞。
修复：升级到 2.1.2 或更高版本。

Package	Affected versions	Patched versions
multi-ini multi-ini_project	`< 2.1.2`	`2.1.2`
multi-ini npm	`< 2.1.2`	`2.1.2`

Description

This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448.

NVD description

This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448.

References

nvd.nist.gov/vuln/detail/CVE-2020-28460 · ADVISORY
evangelion1204/multi-ini commit 6b2212b · WEB
snyk.io/vuln/SNYK-JS-MULTIINI-1053229 · WEB

multi-ini 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free