ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse`

Description

This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.

Recommendation

No fix is available yet. Followings are affected versions:

<= 0.5.2

References

GHSA-7vrv-5m2h-rjw9
security.snyk.io
CVE-2020-28462
CWE-1321
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse` and gives you actionable findings to investigate.

Start a free scan

Related Issues

yargs-parser Vulnerable to Prototype Pollution - CVE-2020-7608
json-schema-ref-parser Prototype Pollution issue - CVE-2024-29651
dot-prop Prototype Pollution vulnerability - CVE-2020-8116
Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs - CVE-2025-62374

How to Secure your NodeJs Express Javascript Application - part 2

How to Secure your NodeJs Express Javascript Application - part 1

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated January 27, 2023