MGASA-2021-0068

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2020-7788
Published: 05 Feb 2021, 11:54
Last modified:16 Apr 2026, 04:25

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

05 Feb 2021, 11:54
Published
Vulnerability first disclosed
16 Apr 2026, 04:25
Last Modified
Vulnerability information updated

Description

Updated nodejs-ini package fixes a security vulnerability It was discovered that there was an issue in nodejs-ini, where an application could be exploited by a malicious input file. This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context (CVE-2020-7788).

Affected Systems

  • mageia•nodejs-ini

    < 1.3.8-1.mga7

References (3)