Description
This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context.
Remediation
References
https://github.com/loge5/conf-cfg-ini/commit/3a88a6c52c31eb6c0f033369eed40aa168a636ea
https://security.snyk.io/vuln/SNYK-JS-CONFCFGINI-1048973
Related Vulnerabilities
CVE-2023-44487 Vulnerability in maven package org.eclipse.jetty.http2:http2-common
CVE-2023-37460 Vulnerability in maven package org.codehaus.plexus:plexus-archiver
CVE-2020-26296 Vulnerability in maven package org.webjars.bowergithub.vega:vega
CVE-2016-2175 Vulnerability in maven package org.apache.pdfbox:preflight-app
CVE-2020-24164 Vulnerability in maven package com.taoensso:nippy