Prototype Pollution

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2020-7788 · Microsoft / collected KEV context

EUVD-2020-1502

GHSA-qqgx-2p2h-9c37

SNYK-JS-INI-1048974

cve-program · CVE-2020-7788

• https://snyk.io/vuln/SNYK-JS-INI-1048974
• https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1
• https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html

euvd · EUVD-2020-1502

• https://snyk.io/vuln/SNYK-JS-INI-1048974
• https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1
• https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html

nvd · CVE-2020-7788

• https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1
• https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html
• https://snyk.io/vuln/SNYK-JS-INI-1048974

osv · GHSA-qqgx-2p2h-9c37

• https://nvd.nist.gov/vuln/detail/CVE-2020-7788
• https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1
• https://github.com/npm/ini
• https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html
• https://snyk.io/vuln/SNYK-JS-INI-1048974
• https://www.npmjs.com/advisories/1589

• This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the conte… · Advisory content revised · 9 Nov 2026