{"action":"Upgrade conf-cfg-ini to 1.2.2 or later.","affected":[{"fixed":"1.2.2","introduced":"0"}],"component":"conf-cfg-ini","cve_ids":["CVE-2020-28441"],"ecosystem":"npm","epss":0.01222,"exploited":false,"fixed_versions":["1.2.2"],"ghsa_id":"GHSA-m6mg-jvjf-w44x","id":"tcs_01M5KFZW23THP6JK21XKB9MX9W","modified_at":"2023-11-08T04:03:26.350691Z","published_at":"2022-07-26T00:01:06Z","references":["https://osv.dev/vulnerability/GHSA-m6mg-jvjf-w44x","https://nvd.nist.gov/vuln/detail/CVE-2020-28441","https://github.com/loge5/conf-cfg-ini/commit/3a88a6c52c31eb6c0f033369eed40aa168a636ea","https://github.com/loge5/conf-cfg-ini/commit/ecd878f8f7398e765739e989c7fe7cc052308947","https://github.com/loge5/conf-cfg-ini","https://security.snyk.io/vuln/SNYK-JS-CONFCFGINI-1048973"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-m6mg-jvjf-w44x","url":"https://osv.dev/vulnerability/GHSA-m6mg-jvjf-w44x"}],"summary":"conf-cfg-ini Prototype Pollution via malicious INI file before v1.2.2"}