CVE-2020-28448: Multi-Ini Project Multi-Ini

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array.

Affected products

• Multi-Ini Project Multi-Ini: before 2.1.1 (fixed in 2.1.1)

Published 2020-12-22. Last modified 2026-06-17.