ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse`

Description

This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.5.2

References

• GHSA-7vrv-5m2h-rjw9
• security.snyk.io
• CVE-2020-28462
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• yargs-parser Vulnerable to Prototype Pollution - CVE-2020-7608
• json-schema-ref-parser Prototype Pollution issue - CVE-2024-29651
• dot-prop Prototype Pollution vulnerability - CVE-2020-8116
• Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs - CVE-2025-62374

You might also like:

How to Secure your NodeJs Express Javascript Application - part 2

How to Secure your NodeJs Express Javascript Application - part 1

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

ion-parser