GitHub Advisoryadvisory · npm

GHSA-x72j-hv9f-qqh4 parse-ini is vulnerable to Prototype Pollution in index.js()

CRITICAL Published 2026-05-07 Modified 2026-05-12 Official page ↗

Aliases: CVE-2025-63703
Ecosystem: npm
Packages: parse-ini
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-1321
Reviewed: 2026-05-12

Affected packages

• npm parse-ini: 1.0.6 (no fix yet)

Description

npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js().

Related

Alias · CVE (1)

CVE-2025-63703 npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js(). vulnerability

Weakness · CWE (1)

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References