high 7.3

CVE-2020-7788 json

Prototype Pollution

published 2020-12-10 5y ago modified 2026-10-08 last mo. also GHSA-qqgx-2p2h-9c37 , EUVD-2020-1502

cvss: 7.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 3.7%; EPSS 3.7% chance of exploitation in 30 days, percentile 89%
public exploits: 0; none known

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Patch / fix

fixed in 2 distros 4 links 1

npm ini 1.3.6
n/a ini 1.3.6

debian red hat almalinux rocky linux

node-ini Debian 14, Debian 13, Debian 12 2.0.0-1

debian advisories DEBIAN-CVE-2020-7788

npm RHEL 8 1:6.14.15-1.14.18.2.2.module+el8.5.0+13644+8d46dafd
nodejs RHEL 8 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-nodemon RHEL 8 2.0.15-1.module+el8.5.0+13504+a2e74d91
nodejs-full-i18n RHEL 8 1:14.18.2-2.module+el8.5.0+13644+8d46dafd
nodejs-packaging RHEL 8, RHEL 8.4 EUS 23-3.module+el8.3.0+6519+9f98ed83
npm RHEL 8 1:8.1.2-1.16.13.1.3.module+el8.5.0+13548+45d748af
nodejs RHEL 8 1:16.13.1-3.module+el8.5.0+13548+45d748af
nodejs-nodemon RHEL 8 2.0.15-1.module+el8.5.0+13548+45d748af

red hat advisories RHSA-2022:0350 RHSA-2021:5171 RHSA-2022:0246 RHSA-2022:6595 RHSA-2021:3280 RHSA-2021:3281

nodejs AlmaLinux 9 1:16.16.0-1.el9_0
nodejs-nodemon AlmaLinux 9 2.0.19-1.el9_0
npm AlmaLinux 9 1:8.11.0-1.16.16.0.1.el9_0
nodejs-libs AlmaLinux 9 1:16.16.0-1.el9_0
nodejs-full-i18n AlmaLinux 9 1:16.16.0-1.el9_0
npm AlmaLinux 8 1:6.14.15-1.14.18.2.2.module_el8.5.0+2618+8d46dafd
npm AlmaLinux 8 1:6.14.15-1.14.18.2.2.module_el8.5.0+254+b4526b16
nodejs AlmaLinux 8 1:14.18.2-2.module_el8.5.0+2618+8d46dafd

almalinux advisories ALSA-2022:6595 ALSA-2022:0350 ALSA-2021:5171 ALSA-2021:0551 ALSA-2021:0549 ALSA-2021:0548

nodejs-nodemon Rocky Linux 9 2.0.19-1.el9_0
nodejs Rocky Linux 8 1:14.18.2-2.module+el8.5.0+733+de4fee6c
nodejs-nodemon Rocky Linux 8 2.0.15-1.module+el8.5.0+721+4c107270
nodejs-packaging Rocky Linux 8 23-3.module+el8.7.0+1071+4bdda2a8
nodejs-packaging Rocky Linux 8 23-3.module+el8.3.0+100+234774f7
nodejs-packaging Rocky Linux 8 23-3.module+el8.5.0+733+de4fee6c
nodejs Rocky Linux 8 1:16.13.1-3.module+el8.5.0+721+4c107270
nodejs-packaging Rocky Linux 8 25-1.module+el8.6.0+1046+80feca58

rocky linux advisories RLSA-2022:6595 RLSA-2022:0350 RLSA-2021:5171 RLSA-2021:0551 RLSA-2021:0549 RLSA-2021:0548

github.com/npm/ini@56d2805 commit

Is CVE-2020-7788 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-7788 updated 2026-11-05 cvss 7.3

nodejs-ini: Prototype pollution via malicious INI file

Red Hat Software Collections rh-nodejs10-nodejs-nodemon
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux AppStream (v. 8) nodejs 10.23.1-1.module+el8.3.0+9502+012d8a97, nodejs 12.20.1-1.module+el8.3.0+9503+19cb079c, nodejs 14.15.4-2.module+el8.3.0+9635+ffdf8381, nodejs 14.18.2-2.module+el8.5.0+13644+8d46dafd, nodejs 16.13.1-3.module+el8.5.0+13548+45d748af, nodejs-packaging 17-3.module+el8+2873+aa7dfd9a, +18 more
fixed: vendor fix RHSA-2021:0548
Red Hat Enterprise Linux AppStream (v. 9) nodejs-nodemon 2.0.19-1.el9_0
fixed: vendor fix RHSA-2022:6595
Red Hat Enterprise Linux AppStream EUS (v.8.4) nodejs 14.18.2-2.module+el8.4.0+13643+6c0ebf22, nodejs-packaging 23-3.module+el8.3.0+6519+9f98ed83, nodejs-nodemon 2.0.15-1.module+el8.4.0+13503+fc29810b, npm 6.14.15-1.14.18.2.2.module+el8.4.0+13643+6c0ebf22, nodejs-full-i18n 14.18.2-2.module+el8.4.0+13643+6c0ebf22
fixed: vendor fix RHSA-2022:0246
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-nodejs 10.23.1-2.el7, rh-nodejs12-nodejs 12.20.1-1.el7, rh-nodejs12-nodejs 12.22.5-1.el7, rh-nodejs14-nodejs 14.15.4-2.el7, rh-nodejs10-npm 6.14.10-10.23.1.2.el7, rh-nodejs12-npm 6.14.10-12.20.1.1.el7, +5 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-nodejs 10.23.1-2.el7, rh-nodejs12-nodejs 12.20.1-1.el7, rh-nodejs14-nodejs 14.15.4-2.el7, rh-nodejs10-npm 6.14.10-10.23.1.2.el7, rh-nodejs12-npm 6.14.10-12.20.1.1.el7, rh-nodejs14-npm 6.14.10-14.15.4.2.el7, +1 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-nodejs 10.23.1-2.el7, rh-nodejs12-nodejs 12.20.1-1.el7, rh-nodejs12-nodejs 12.22.5-1.el7, rh-nodejs14-nodejs 14.15.4-2.el7, rh-nodejs10-npm 6.14.10-10.23.1.2.el7, rh-nodejs12-npm 6.14.10-12.20.1.1.el7, +5 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-nodejs 10.23.1-2.el7, rh-nodejs12-nodejs 12.20.1-1.el7, rh-nodejs12-nodejs 12.22.5-1.el7, rh-nodejs14-nodejs 14.15.4-2.el7, rh-nodejs10-npm 6.14.10-10.23.1.2.el7, rh-nodejs12-npm 6.14.10-12.20.1.1.el7, +5 more
fixed: vendor fix RHSA-2021:0521
Red Hat Enterprise Linux 9 npm, nodejs, nodejs-libs, nodejs-full-i18n Red Hat Enterprise Linux AppStream (v. 9) nodejs 16.16.0-1.el9_0, nodejs-libs 16.16.0-1.el9_0, npm 8.11.0-1.16.16.0.1.el9_0, nodejs-full-i18n 16.16.0-1.el9_0 Red Hat Quay 3 yarnpkg-ini Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs14-nodejs 14.17.5-1.el7, rh-nodejs14-npm 6.14.14-14.17.5.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs14-nodejs 14.17.5-1.el7, rh-nodejs14-npm 6.14.14-14.17.5.1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs14-nodejs 14.17.5-1.el7, rh-nodejs14-npm 6.14.14-14.17.5.1.el7
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: last mo. (2026-10-08)

Exploit prediction

3.66% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

snyk.io https://snyk.io/vuln/SNYK-JS-INI-1048974 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
CNA	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem	package	affected	fixed in
npm	ini	<1.3.6	1.3.6

Affected products

n/a ini

Classification

Weakness

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

github.com /npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1
web, patch, third-party-advisory
snyk.io /vuln/SNYK-JS-INI-1048974
web, exploit, third-party-advisory
lists.debian.org /debian-lts-announce/2020/12/msg00032.html
mailing-list, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2020-7788
advisory
github.com /npm/ini
package
npmjs.com /advisories/1589
web

Sources

CVE List CVE-2020-7788
GitHub Advisory GHSA-qqgx-2p2h-9c37
NVD CVE-2020-7788

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.