npm/@aws-sdk/shared-ini-file-loader CVE-2020-28472: high 7.3, EPSS 2.17%

Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader

Action: Upgrade @aws-sdk/shared-ini-file-loader to 1.0.0-rc.9 or later.

npm i @aws-sdk/shared-ini-file-loader@1.0.0-rc.9

Affected

Fixed versions

Sources

• osv: GHSA-rrc9-gqf8-8rwg#npm/@aws-sdk/shared-ini-file-loader
• https://nvd.nist.gov/vuln/detail/CVE-2020-28472
• https://github.com/aws/aws-sdk-js/pull/3585/commits/7d72aff2a941173733fcb6741b104cd83d3bc611
• https://github.com/aws/aws-sdk-js-v3/commit/a209082dff913939672bb069964b33aa4c5409a9
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1059426
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059425
• https://snyk.io/vuln/SNYK-JS-AWSSDK-1059424
• https://snyk.io/vuln/SNYK-JS-AWSSDKSHAREDINIFILELOADER-1049304

CVE-2020-28472 · published 2021-11-16T21:26:43Z · modified 2025-01-14T08:57:08.927770Z · JSON