CVE-2020-7788

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

• CWE-1321

• https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/12/msg00032.htmlMailing List, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-INI-1048974Exploit, Third Party Advisory
• https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/12/msg00032.htmlMailing List, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-INI-1048974Exploit, Third Party Advisory

Published

Dec 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7781This affects the package connection-tester before 0.2.1. The…9.8
• CVE-2020-7782This affects all versions of package spritesheet-js. It depe…9.8
• CVE-2020-7784This affects all versions of package ts-process-promises. Th…9.8
• CVE-2020-7785This affects all versions of package node-ps. The injection …9.8
• CVE-2020-7786This affects all versions of package macfromip. The injectio…9.8
• CVE-2020-7787This affects all versions of package react-adal. It is possi…8.2
• CVE-2020-7789This affects the package node-notifier before 9.0.0. It allo…5.6
• CVE-2020-7790This affects the package spatie/browsershot from 0.0.0. By s…5.3
• CVE-2020-7791This affects the package i18n before 2.1.15. Vulnerability a…7.5
• CVE-2020-7792This affects all versions of package mout. The deepFillIn fu…7.5
• CVE-2020-7793The package ua-parser-js before 0.7.23 are vulnerable to Reg…7.5
• CVE-2020-7794This affects all versions of package buns. The injection poi…9.8