CVE-2020-28441

Name of the Vulnerable Software and Affected Versions conf-cfg-ini versions prior to 1.2.2

Description The issue arises when an attacker submits a malicious INI file to an application that parses it with decode, resulting in prototype pollution on the application. This can be exploited further depending on the context.

Recommendations For versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue. As a temporary workaround, consider restricting the parsing of INI files with decode to minimize the risk of exploitation.