CVE-2020-28461

This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.

• CWE-1321

• https://github.com/Sdju/js-ini/commit/fa17efb7e3a7c9464508a254838d4c231784931ePatch, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JS-JSINI-1048970Exploit, Third Party Advisory
• https://github.com/Sdju/js-ini/commit/fa17efb7e3a7c9464508a254838d4c231784931ePatch, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JS-JSINI-1048970Exploit, Third Party Advisory

Published

Jul 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-28456The package s-cart/core before 4.4 are vulnerable to Cross-s…6.1
• CVE-2020-28457This affects the package s-cart/core before 4.4. The search …4.8
• CVE-2020-28458All versions of package datatables.net are vulnerable to Pro…7.3
• CVE-2020-28459This affects all versions of package markdown-it-decorate. A…6.1
• CVE-2020-2846Vulnerability in the Oracle Depot Repair product of Oracle E…8.2
• CVE-2020-28460This affects the package multi-ini before 2.1.2. It is possi…8.1
• CVE-2020-28462This affects all versions of package ion-parser. If an attac…9.8
• CVE-2020-28463All versions of package reportlab are vulnerable to Server-s…6.5
• CVE-2020-28464This affects the package djv before 2.1.4. By controlling th…9.8
• CVE-2020-28466This affects all versions of package github.com/nats-io/nats…7.5
• CVE-2020-28468This affects the package pwntools before 4.3.1. The shellcra…9.8
• CVE-2020-28469This affects the package glob-parent before 5.1.2. The enclo…7.5