GitHub Advisoryadvisory · npm

GHSA-8g77-54rh-46hx Prototype Pollution Vulnerability in parse-git-config

HIGH Published 2025-03-12 Modified 2025-03-20 Official page ↗
Aliases
CVE-2025-25975
Ecosystem
npm
Packages
parse-git-config
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-1321, CWE-200
Reviewed
2025-03-16

Affected packages

• npm parse-git-config: <= 3.0.0 (no fix yet)

Description

An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function.

Related

Alias · CVE (1)

  • CVE-2025-25975 An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References