Skip to content
Sign in
5.6 Medium

CVE-2020-28460 This affects the package multi-ini before 2.1.2

Description

This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448.

Affected products and versions

Product Affected versions Fixed in
multi-ini 2.1 earliest → < 2.1.2 2.1.2

Other CVEs of multi-ini

The 2 CVEs of multi-ini →
CVE-2020-28448 This affects the package multi-ini before 2.1.1 5.6 Medium
Track this CVE