CVE-2020-28441

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1321

Affected software

No affected versions have been published.

Timeline

Published
Jul 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-284429.8All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function.CVE-2020-284439.8This affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js.CVE-2020-284459.8This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion() functionCVE-2020-284469.8The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js.CVE-2020-284479.8This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath)CVE-2020-284489.8This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of aCVE-2020-284498.6This affects all versions of package decal. The vulnerability is in the set function.CVE-2020-28458.2Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Estimate and Actual Charges). Supported versions thaCVE-2020-284508.6This affects all versions of package decal. The vulnerability is in the extend function.CVE-2020-284519.8This affects the package image-tiler before 2.0.2.CVE-2020-284528.8This affects the package com.softwaremill.akka-http-session:core_2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akkaCVE-2020-284539.8This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js.
CVE-2020-28441: Critical severity, CVSS 9.8 | Vulnix