{"action":"Upgrade js-ini to 1.3.0 or later.","affected":[{"fixed":"1.3.0","introduced":"0"}],"component":"js-ini","cve_ids":["CVE-2020-28461"],"ecosystem":"npm","epss":0.01222,"exploited":false,"fixed_versions":["1.3.0"],"ghsa_id":"GHSA-m939-vrfp-9v8p","id":"tcs_01M5KG082FJQWWGNM3KRGKJX0T","modified_at":"2023-11-08T04:03:27.258589Z","published_at":"2022-07-26T00:01:05Z","references":["https://osv.dev/vulnerability/GHSA-m939-vrfp-9v8p","https://nvd.nist.gov/vuln/detail/CVE-2020-28461","https://github.com/Sdju/js-ini/commit/fa17efb7e3a7c9464508a254838d4c231784931e","https://github.com/Sdju/js-ini","https://security.snyk.io/vuln/SNYK-JS-JSINI-1048970"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-m939-vrfp-9v8p","url":"https://osv.dev/vulnerability/GHSA-m939-vrfp-9v8p"}],"summary":"js-ini Prorotype Pollution when malicious INI files submitted to an application that parses it with `parse`"}