{"id":"CVE-2020-7788","revision":"cb89aa8784d54520871f08e1e7998c9f","records":[{"revision":"cb89aa8784d54520871f08e1e7998c9f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2020-7788","aliases":[],"title":"Prototype Pollution","description":"This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.","state":0,"publishedAt":"2020-12-11T10:45:14.077+00:00","modifiedAt":"2026-10-08T21:13:48.353+00:00","affected":[{"ecosystem":"Vendor product","name":"ini","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"ini\",\n                    \"vendor\": \"n/a\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"1.3.6\",\n                            \"status\": \"affected\",\n                            \"version\": \"unspecified\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P","score":7.3,"severity":"HIGH"}],"references":["https://snyk.io/vuln/SNYK-JS-INI-1048974","https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1","https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2020-7788","license":"CVE Program Terms of Use","key":"cve-program:CVE-2020-7788","identifiers":["CVE-2020-7788"]},"retained":false,"historicalAffected":[]}],"coverage":[]}