CVE-2020-28460: Multi-Ini Project Multi-Ini

High severity, CVSS 8.1. EPSS: 1.5% chance of exploitation in the next 30 days.

This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448.

Affected products

• Multi-Ini Project Multi-Ini: before 2.1.2 (fixed in 2.1.2)

Published 2020-12-22. Last modified 2026-06-17.