CVE-2020-28461

CVE-2020-28461 is a critical prototype pollution vulnerability affecting the js-ini package prior to version 1.3.0. An attacker can submit a malicious INI file to an application using js-ini's parse function, leading to prototype pollution and potential further exploitation. With a CVSS score of 9.8 (Critical), this vulnerability has a network-based attack vector, low attack complexity, and high impacts on confidentiality, integrity, and availability. While no active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion has been observed, its high FAUCET Risk Score of 79/100 indicates a notable potential risk.