# CVE-2020-28471: Properties-Reader prototype pollution

Source: https://junglewise.ai/threats/cve-2020-28471-properties-reader-prototype-pollution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-07-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-28471 · Severity: low · CVSS 3.1 · Published 2022-07-19

Properties-Reader is a Node.js library used to parse and read properties files. Before version 2.2.0, it is vulnerable to prototype pollution—a JavaScript-specific attack where malicious properties files can modify core JavaScript object prototypes. An attacker can exploit this to manipulate application behavior, potentially leading to privilege escalation, authentication bypass, or arbitrary code execution depending on how the application uses affected objects.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-28471 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-28471 being exploited in the wild.

**How severe is CVE-2020-28471?** Low severity, with a CVSS score of 3.1, published 19 July 2022.

**Which products and versions are affected?** properties-reader (npm) SEMVER:introduced=0,fixed=2.2.0.

**Is there a fix for CVE-2020-28471?** Yes. properties-reader (npm): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-28471 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-28471?** Check whether you run properties-reader (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- properties-reader (npm): upgrade to 2.2.0 or later

  ```sh
  npm install properties-reader@2.2.0
  ```


## Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in Properties-Reader versions before 2.2.0. The library fails to safely handle property names in parsed files, allowing an attacker to inject a `__proto__` key that pollutes the Object prototype. No authentication or special privileges are required—an attacker only needs to supply a malicious properties file to the application. Once parsed, the pollution affects all downstream JavaScript objects in the application's runtime. The issue is patched in version 2.2.0 and subsequent releases.

## Affected products

- steveukx properties-reader before 2.2.0

## Identifiers

- CVE-2020-28471
- GHSA-jxvf-m3x5-mxwq

## Timeline

- 2020-12-30: disclosed: Vulnerability reported to GitHub
- 2022-07-19: patched: Fix released in version 2.2.0
- 2022-07-19: advisory: GHSA advisory published
- 2022-07-25: other: CVE-2020-28471 published by NVD

## References

- [https://github.com/steveukx/properties/issues/40](https://github.com/steveukx/properties/issues/40)