critical
CVE-2020-7788
nodejs-ini: Prototype pollution via malicious INI file
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Red Hat7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high), Red Hat (medium), AlmaLinux (medium), Oracle (medium), Rocky Linux (medium), Ubuntu (medium).
Description
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alma 8 | nodejs:10::nodejs-nodemon, nodejs:10::nodejs-packaging, nodejs:12::nodejs-nodemon and 15 more | 2.0.3-1.module_el8.4.0+2521+c668cc9f and 10 more |
| alma 9 | nodejs, nodejs-docs, nodejs-full-i18n and 3 more | 1:16.16.0-1.el9_0 and 2 more |
| chainguard | code-server, commercial-gitlab-rails-ee-19.2, commercial-gitlab-rails-ee-19.3 and 38 more | 0 |
| debian 10 | node-ini | 1.3.5-1+deb10u1 |
| debian 11 | node-ini | 2.0.0-1 |
| debian 12 | node-ini | 2.0.0-1 |
| debian 13 | node-ini | 2.0.0-1 |
| debian 14 | node-ini | 2.0.0-1 |
| debian 9 | node-ini | 1.1.0-1+deb9u1 |
| echo | node-ini | 2.0.0-1 |
| npm::GitHub Security Advisory npm | ini | 1.3.6 |
| Oracle Linux 8 | nodejs, nodejs-devel, nodejs-docs and 4 more | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 and 3 more |
Show all 124 entries from 23 sources
| Source | Package | Fixed in |
|---|---|---|
| alma 8 | nodejs:10::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:10::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| alma 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:12::nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| alma 8 | nodejs:14::nodejs | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:14::nodejs-devel | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:14::nodejs-docs | 1:14.18.2-2.module_el8.5.0+254+b4526b16 |
| alma 8 | nodejs:14::nodejs-full-i18n | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:14::nodejs-nodemon | 2.0.15-1.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:14::nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| alma 8 | nodejs:14::npm | 1:6.14.15-1.14.18.2.2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:16::nodejs | 1:16.13.1-3.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-devel | 1:16.13.1-3.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-docs | 1:16.13.1-3.module_el8.5.0+246+05401605 |
| alma 8 | nodejs:16::nodejs-full-i18n | 1:16.13.1-3.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-nodemon | 2.0.15-1.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-packaging | 25-1.module_el8.5.0+246+05401605 |
| alma 8 | nodejs:16::npm | 1:8.1.2-1.16.13.1.3.module_el8.5.0+2605+45d748af |
| alma 9 | nodejs | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-docs | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-full-i18n | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-libs | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-nodemon | 2.0.19-1.el9_0 |
| alma 9 | npm | 1:8.11.0-1.16.16.0.1.el9_0 |
| chainguard | code-server | 0 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.4 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.4 | 0 |
| chainguard | gitlab-rails-ce-18.1 | 0 |
| chainguard | gitlab-rails-ce-18.10 | 0 |
| chainguard | gitlab-rails-ce-18.11 | 0 |
| chainguard | gitlab-rails-ce-18.2 | 0 |
| chainguard | gitlab-rails-ce-18.3 | 0 |
| chainguard | gitlab-rails-ce-18.4 | 0 |
| chainguard | gitlab-rails-ce-18.5 | 0 |
| chainguard | gitlab-rails-ce-18.6 | 0 |
| chainguard | gitlab-rails-ce-18.7 | 0 |
| chainguard | gitlab-rails-ce-18.8 | 0 |
| chainguard | gitlab-rails-ce-18.9 | 0 |
| chainguard | gitlab-rails-ce-19.0 | 0 |
| chainguard | gitlab-rails-ce-19.1 | 0 |
| chainguard | gitlab-rails-ce-19.2 | 0 |
| chainguard | gitlab-rails-ce-19.3 | 0 |
| chainguard | gitlab-rails-ce-19.4 | 0 |
| chainguard | gitlab-rails-ce-19.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.1 | 0 |
| chainguard | gitlab-rails-ce-fips-18.10 | 0 |
| chainguard | gitlab-rails-ce-fips-18.11 | 0 |
| chainguard | gitlab-rails-ce-fips-18.2 | 0 |
| chainguard | gitlab-rails-ce-fips-18.3 | 0 |
| chainguard | gitlab-rails-ce-fips-18.4 | 0 |
| chainguard | gitlab-rails-ce-fips-18.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.6 | 0 |
| chainguard | gitlab-rails-ce-fips-18.7 | 0 |
| chainguard | gitlab-rails-ce-fips-18.8 | 0 |
| chainguard | gitlab-rails-ce-fips-18.9 | 0 |
| chainguard | gitlab-rails-ce-fips-19.0 | 0 |
| chainguard | gitlab-rails-ce-fips-19.1 | 0 |
| chainguard | gitlab-rails-ce-fips-19.2 | 0 |
| chainguard | gitlab-rails-ce-fips-19.3 | 0 |
| chainguard | gitlab-rails-ce-fips-19.4 | 0 |
| chainguard | gitlab-rails-ce-fips-19.5 | 0 |
| debian 10 | node-ini | 1.3.5-1+deb10u1 |
| debian 11 | node-ini | 2.0.0-1 |
| debian 12 | node-ini | 2.0.0-1 |
| debian 13 | node-ini | 2.0.0-1 |
| debian 14 | node-ini | 2.0.0-1 |
| debian 9 | node-ini | 1.1.0-1+deb9u1 |
| echo | node-ini | 2.0.0-1 |
| npm::GitHub Security Advisory npm | ini | 1.3.6 |
| Oracle Linux 8 | nodejs | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-devel | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-docs | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-full-i18n | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-nodemon | 2.0.15-1.module+el8.5.0+20489+261d51d3 |
| Oracle Linux 8 | nodejs-packaging | 25-1.module+el8.5.0+20388+4b61e68d |
| Oracle Linux 8 | npm | 1:8.1.2-1.16.13.1.3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 9 | nodejs | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-docs | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-full-i18n | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-libs | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-nodemon | 2.0.19-1.el9_0 |
| Oracle Linux 9 | npm | 1:8.11.0-1.16.16.0.1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-docs | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-full-i18n | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-libs | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-nodemon | 0:2.0.19-1.el9_0 |
| rapidfort Oracle Linux 9 | npm | 1:8.11.0-1.16.16.0.1.el9_0 |
| rocky 8 | nodejs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-devel | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-docs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-full-i18n | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-nodemon | 2.0.15-1.module+el8.6.0+978+59f26232 |
| rocky 8 | nodejs:10::nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 |
| rocky 8 | nodejs:10::nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 |
| rocky 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| rocky 8 | nodejs:12::nodejs-packaging | 23-3.module+el8.7.0+1071+4bdda2a8 |
| rocky 8 | nodejs:14::nodejs | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-devel | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-docs | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-full-i18n | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-nodemon | 2.0.15-1.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:14::nodejs-packaging | 23-3.module+el8.7.0+1071+4bdda2a8 |
| rocky 8 | nodejs:14::npm | 1:6.14.15-1.14.18.2.2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:16::nodejs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-devel | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-docs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-full-i18n | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-nodemon | 2.0.15-1.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-packaging | 25-1.module+el8.6.0+1046+80feca58 |
| rocky 8 | nodejs:16::npm | 1:8.1.2-1.16.13.1.3.module+el8.5.0+721+4c107270 |
| rocky 8 | npm | 1:8.1.2-1.16.13.1.3.module+el8.5.0+721+4c107270 |
| rocky 9 | nodejs-nodemon | 2.0.19-1.el9_0 |
| ubuntu 18.04-ESM | node-ini | no fix listed |
| ubuntu 20.04-ESM | node-ini | no fix listed |
| ubuntu 22.04 | node-ini | no fix listed |
| ubuntu 24.04 | node-ini | no fix listed |
| ubuntu 26.04 | node-ini | no fix listed |
| ubuntu 26.10 | node-ini | no fix listed |
| wolfi | code-server | 0 |
References
- https://access.redhat.com/errata/RHSA-2022:6595
- https://access.redhat.com/security/cve/CVE-2020-7788
- https://bugzilla.redhat.com/1907444
- https://bugzilla.redhat.com/1945459
- https://bugzilla.redhat.com/1964461
- https://bugzilla.redhat.com/2007557
- https://bugzilla.redhat.com/2098556
- https://bugzilla.redhat.com/2102001
All 47 references
- https://bugzilla.redhat.com/2105422
- https://bugzilla.redhat.com/2105426
- https://bugzilla.redhat.com/2105428
- https://bugzilla.redhat.com/2105430
- https://bugzilla.redhat.com/show_bug.cgi?id=1907444
- https://bugzilla.redhat.com/show_bug.cgi?id=1945459
- https://bugzilla.redhat.com/show_bug.cgi?id=1964461
- https://bugzilla.redhat.com/show_bug.cgi?id=2007557
- https://bugzilla.redhat.com/show_bug.cgi?id=2098556
- https://bugzilla.redhat.com/show_bug.cgi?id=2102001
- https://bugzilla.redhat.com/show_bug.cgi?id=2105422
- https://bugzilla.redhat.com/show_bug.cgi?id=2105426
- https://bugzilla.redhat.com/show_bug.cgi?id=2105428
- https://bugzilla.redhat.com/show_bug.cgi?id=2105430
- https://bugzilla.redhat.com/show_bug.cgi?id=2121019
- https://bugzilla.redhat.com/show_bug.cgi?id=2124299
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33502
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3807
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29244
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32213
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32214
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32215
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33987
- https://errata.almalinux.org/9/ALSA-2022-6595.html
- https://errata.rockylinux.org/RLSA-2022:6595
- https://github.com/npm/ini
- https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1
- https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1%20%28v1.3.6%29
- https://linux.oracle.com/cve/CVE-2020-7788.html
- https://linux.oracle.com/errata/ELSA-2022-6595.html
- https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-7788
- https://snyk.io/vuln/SNYK-JS-INI-1048974
- https://www.cve.org/CVERecord?id=CVE-2020-7788
- https://www.npmjs.com/advisories/1589