CVE-2020-7788: Debian Linux

Critical severity, CVSS 9.8. EPSS: 3.7% chance of exploitation in the next 30 days.

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Affected products

• Debian Debian Linux: version 9.0 only
• Ini Project Ini: before 1.3.6 (fixed in 1.3.6)

Published 2020-12-11. Last modified 2026-10-08.